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EXECUTIVE SUMMARY 


The National Highway Traffic Safety Administration (NHTSA) issues this report to present our 
studies and findings concerning unintended acceleration (UA) 1 in vehicles manufactured by 
Toyota. This report should be read in conjunction with the report issued by the National 
Aeronautics and Space Administration (NASA) concerning the electronic throttle control (ETC) 
system” in Toyota vehicles. In March 2010, NHTSA enlisted the support of NASA in analyzing 
the Toyota ETC system to determine whether it contained any vulnerabilities that might 
realistically be expected to produce UA in a consumer’s use of those vehicles. NASA did not 
find an electronic cause of large throttle openings that can result in UA incidents. NHTSA did 
not find a vehicle-based cause of those incidents in addition to those causes already addressed by 
Toyota recalls. 

In addition to enlisting NASA to identify any vulnerabilities in the Toyota ETC system, NHTSA 
has obtained the services of the prestigious National Academy of Sciences (NAS) to examine the 
broad subject of UA across the automotive industry, and the safety implications of electronic 
control systems that are increasingly common in motor vehicles. NHTSA expects to receive 
recommendations from NAS in the fall of 2011 on how NHTSA might use its research, 
rulemaking, and enforcement authority to address any such implications identified by the panel. 


NHTSA has conducted several investigations into causes of the alleged UA in Toyota vehicles 
and, in 2010, conducted an additional in-depth study of that subject in connection with the 
NASA study. This report presents details regarding those investigations, as well as NHTSA’s 
most recent study and results of those efforts. The report concludes by outlining the current and 
future work that the agency is conducting in an effort to develop countenneasures to ensure that 
the risk of future fatalities and injuries resulting from UA are minimized. Several potential 


1 In this report, “unintended acceleration" refers to the occurrence of any degree of acceleration that the vehicle 
driver did not purposely cause to occur. Contrast this with the term “sudden acceleration incident,” which refers to 
“unintended, unexpected, high-power accelerations from a stationary position or a very low initial speed 
accompanied by an apparent loss of braking effectiveness.” An Examination of Sudden Acceleration, DOT-TSC- 
NHTSA-89-1 at v. As used here, unintended acceleration is a very broad term that encompasses sudden acceleration 
as well as incidents at higher speeds and incidents where brakes were partially or fully effective, including 
occurrences such as pedal entrapment by floor mats at full throttle and high speeds and incidents of lesser throttle 
openings at various speeds. 

2 In an ETC system, the vehicle’s throttle is controlled electronically based on signals transmitted from the 
accelerator pedal. In a mechanical system, a physical linkage between the accelerator and throttle controls 
acceleration. 



causes of UA were investigated, including vehicle-based defects, such as mechanical or electrical 
failures, and other causes, such as electromagnetic interference and pedal misapplication. 


Through analysis and investigations, NHTSA identified two types of vehicle-based mechanical 
defects as causes of UA. Those were related to pedal entrapment and “sticky pedal.” At the 
urging of NHTSA, Toyota has already recalled more than seven million vehicles because those 
defects could result in UA. To determine whether the scope of the pedal entrapment and sticky 
pedal recalls was sufficiently broad to include all of the vehicles subject to these defects and to 
address all vehicle-based causes of UA known to Toyota, NHTSA initiated a recall query (RQ) 
in February 2010 and analyzed tens of thousands of Toyota documents. NHTSA’s examination 
of the voluminous data did not reveal any previously unknown potential causes of UA. 

NHTSA’s vehicle characterization analysis and testing supported NASA’s review. NHTSA 
found no previously unknown defects in the test vehicles and detennined that their braking 
systems were capable of overcoming all levels of acceleration, including wide open throttle. As 
explained in this report, under certain conditions the vacuum assist that helps drivers apply brake 
pedal force can be diminished; such as by prolonged and repeated rapid use of the brakes. 
Therefore, where the accelerator pedal is stuck in a high throttle position (as can occur in a pedal 
entrapment situation), it is possible that brakes can lose their ability to stop a vehicle. 

After conducting the most exacting study of a motor vehicle electronic control system ever 
perfonned by a government agency, NASA did not find that the ETC electronics are a likely 
cause of large throttle openings in Toyota vehicles as described in consumers’ complaints to 
NHTSA. NASA found that many safety features are designed into the ETC system to prevent 
UA and, if faults are detected, to cause the initiation of safe modes of operation that limit 
acceleration (e.g., limp home, fuel cut strategies). NASA found no flaws in the software code 
controlling the Toyota ETC system that would cause UA. NASA also found that 
electromagnetic compatibility (EMC) testing at exposure levels well above current certification 
standards did not produce an open throttle. NASA found no evidence that any failures of the 
ETC system had an effect on the perfonnance of the braking system. 

NASA’s study confirmed that there is a theoretical possibility that two faults could combine 
under very specific conditions to affect the ETC systems so as to create an unintended UA, but 
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did not find any evidence that this had occurred in the real world or that there are failure 
mechanisms that would combine to make this occurrence likely. NASA identified certain 
aspects of the ETC system that could produce very small throttle openings (less than 5 degrees) 
that are readily controlled by minimal braking force and pose no appreciable safety risk. NASA 
also identified certain apparently rare conditions that could lead to a fail safe mode that may 
involve small, irregular throttle openings in vehicles equipped with potentiometer pedal sensors 
that experience a particular kind of resistive short circuit. However, in these very rare events, 
simply releasing the accelerator pedal closes the throttle and the brakes are fully operational. 
NHTSA does not find these minor, controllable conditions to constitute significant safety risks. 
Of course, NHTSA will continue to monitor all UA complaints and address any such risks that 
may emerge. 

NHTSA and NASA both reviewed relevant consumer complaints and warranty data in great 
detail. Both agencies noted that publicity surrounding NHTSA’s investigations, related recalls, 
and Congressional hearings was the major contributor to the timing and volume of complaints. 
Both also noted that the vast majority of complaints involved incidents that originated when the 
vehicle was stationary or at very low speeds and contained allegations of very wide throttle 
openings, often with allegations that brakes were not effective. NHTSA’s analysis indicated that 
these types of complaints generally do not appear to involve vehicle-based causes and that, 
where the complaint included allegations that the brakes were ineffective or that the incident 
began with a brake application, the most likely cause of the acceleration was actually pedal 
misapplication (i.e., the driver’s unintended application of the accelerator rather than, or in 
addition to, the brake). 

The results of NHTSA’s field inspections of vehicles involved in alleged UA incidents during 
2010 supported this analysis. Those vehicle inspections, which included objective evidence from 
event data recorders, indicated that drivers were applying the accelerator and not applying the 
brake (or not applying it until the last second or so), except for one instance involving pedal 
entrapment. 

3 Pedal misapplication is a known cause of unintended acceleration. Perhaps the most tragic example was a July 16, 
2003 incident in Santa Monica, California that resulted in 10 fatalities and 63 injuries (occurring over the course of 
750 feet of vehicle movement). The National Transportation Safety Board’s report on the incident is available at 
http://www.ntsb.gov/publicIn/2004/har0404.pdf . A more recent report from the board examines pedal 
misapplication in large vehicles. See http://www.ntsb.gov/publictn/2009/SIR0902.pdf . 
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However, NHTSA does not have reason to believe that pedal misapplication is a cause of the 
relatively few, prolonged, high speed UA incidents that present the greatest safety risk. NHTSA 
believes that those incidents are most likely the result of pedal entrapment by a floor mat that 
holds the accelerator pedal in an open throttle position. 

In summary, the combined work of NASA and NHTSA identified no electronic cause of UA 
incidents involving large throttle openings and no reason to believe that any failure of the ETC 
system would affect a vehicle’s braking system. Based on NASA’s findings, observations, and 
recommendation and its own work, NHTSA has decided to take several actions aimed at 
diminishing the risk of UA and strengthening the agency’s ability to address current and future 
issues related to the safety of electronic control systems: 

• NHTSA will consider initiating rulemakings on brake override systems, keyless ignition 
systems, and event data recorders. Brake override systems may prevent or mitigate some 
UA incidents by ensuring that, when the brake is applied, the braking system has priority 
over the throttle. NASA observes in its report (Observation 0-2) that such a system 
“provides a broad overarching defense against unintended engine power” from a wide 
range of causes. Keyless ignition systems can exacerbate UA incidents (particularly 
prolonged incidents involving a stuck accelerator pedal) if the driver cannot determine 
how to shut off the engine quickly. Event data recorders can provide crash investigators 
objective infonnation relevant to UA incidents that result in crashes sufficient to trigger 
the devices. 

• NHTSA will begin preliminary research on the reliability and security of electronic 
control systems by examining existing industry and international standards for best 
practices and relevance to automotive applications. In this research, NHTSA will give 
full consideration to NASA’s recommendation that NHTSA consider controls for 
managing safety critical functions as currently applied to the railroad, aerospace, military, 
and medical sectors. NHTSA will also give full consideration to NASA’s findings and 
observations as they relate to the use of diagnostic trouble codes in conveying safety- 
critical information to drivers, safety-critical software design and validation 
methodologies, and robust fail-safe strategies that protect against two-fault scenarios 
(including those involving resistive short circuits and latent faults). The agency 
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anticipates that the NAS panel will offer recommendations on these subjects and wishes 
to enhance its own understanding of the subject area. 

• NHTSA will begin research on the placement of accelerator and brake pedals and driver 
usage of pedals. NHTSA is interested in learning whether pedal misapplication can be 
significantly reduced through pedal placement specifications and operational 
characteristics. 

• Along with NASA, NHTSA will brief the National Academy of Sciences panel that is 
conducting a broader study of UA and electronic control systems to ensure that the panel 
has the benefit of the work done by the two agencies. 

• NHTSA will continue its plans to enhance its knowledge and capabilities in the area of 
safety-critical vehicle electronics, including electronic control systems, both by ensuring 
that current staff continues to be well infonned on the developing technologies and 
potential safety issues and by hiring (as agency needs dictate and funding pennits) more 
staff with the necessary expertise. 
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1.0 BACKGROUND 


Under the Motor Vehicle and Traffic Safety Act, vehicle and equipment manufacturers have a 
duty to conduct recall actions when they learn that their products either do not comply with a 
Federal Motor Vehicle Safety Standard (FMVSS) or contain a safety-related defect. NHTSA has 
the authority to conduct investigations to detennine whether a noncompliance or safety defect 
exists. If NHTSA concludes that a recall is required but the manufacturer does not agree, 
NHTSA can order the manufacturer to conduct a recall. NHTSA can seek enforcement of such 
an order in Federal court, where it would have to prove the noncompliance or safety defect. 

To demonstrate the existence of a safety defect, NHTSA needs to show both that a defect exists 
and that it is safety-related. To do so, NHTSA would need to prove that a substantial number of 
failures attributable to the defect have occurred or is likely to occur in consumers’ use of the 
vehicle or equipment and that the failures pose an unreasonable risk to motor vehicle safety. 

NHTSA’s Office of Defects Investigation (ODI) receives tens of thousands of Vehicle Owner 
Questionnaires 4 (VOQs) and voluminous early warning information from manufacturers every 
year, both of which are sources of infonnation on potential defects. ODI’s screening divisions 
(the Early Warning Division and the Defects Assessment Division) constantly review these and 
other sources of infonnation to identify possible safety defect trends. When they observe what 
may be a defect trend they recommend that one of the investigating divisions open an 
investigation. After thorough discussion involving ODI management and screening staff, ODI 
decides whether to open an investigation. 

ODI investigations begin with a preliminary evaluation (PE), which is generally completed 
within 120 days. If ODI believes it has sufficient evidence to warrant further investigation and 
the manufacturer does not agree to do a recall, ODI opens a more in-depth Engineering Analysis 
(EA). During both stages of an investigation ODI seeks relevant infonnation from the 
manufacturer and continues to review infonnation from consumers, sometimes interviewing 
them and examining their vehicles or equipment for evidence of a defect. Manufacturers of 
vehicles and equipment conduct several hundred safety recalls each year in the United States. 

4 VOQs are complaints received from consumers about possible safety problems they have experienced with their 
vehicles or motor vehicle equipment. NHTSA receives 30,000 to 40,000 VOQs in an average year, but received 
more than 50,000 in just the first nine months of 2010. 
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The majority of the recalls occur without NHTSA’s having opened an investigation. 
Manufacturers have a duty to conduct the recalls when they leam of a safety defect or 
noncompliance. But many of the largest recalls result from NHTSA’s investigations, particularly 
its defect investigations. For example, of the 16.4 million vehicles recalled in 2009, 49 percent 
of those vehicles were covered by recalls influenced by NHTSA’s investigations, although only 
30 percent of the recalls were influenced. Also included in the overall 2009 vehicle total are 
over four million Toyota vehicles that, although not counted among the influenced recalls, were 
recalled for UA issues based on NHTSA’s strong urging as it prepared to open investigations on 
those matters. 

1.1 UA-Related Defect Investigations Involving Toyota Products 

NHTSA has conducted eight separate investigative actions involving UA in Toyota products 
since calendar year 2000. Seven of the investigations involved vehicles equipped with Toyota’s 
ETCS-i electronic throttle control (ETC) system. Of the eight, two actions were initiated as a 
result of internal NHTSA evaluations; both of these resulted in safety recalls. Five actions were 
conducted at the request of outside parties, via a defect petition 5 (DP), and one action was 
opened based on NHTSA’s assessment and a DP. None of these last six investigations resulted 
in a safety recall. Table 1 summarizes the eight actions. In addition, NHTSA has conducted a 
review of recent Toyota recalls involving UA to determine whether the scope of those recalls 
was sufficient. This inquiry, known as a Recall Query, is described below. 


5 The defect petition process is described at 49 USC 30162 and 49 CFR Part 552. The statute provides concerned 
citizens and other interested parties a means by which they can request that the agency conduct an analysis of a 
potential safety defect issue and make a determination as to whether a formal investigation is warranted. Generally 
speaking the analysis conducted during a petition is the same as that conducted in a preliminary evaluation initiated 
by ODI. 
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Table 1: Summary Details of the Eight ODI UA Investigations Conducted Since CY 2000 Involving Toyota Products 


Act. # 

Open 

Year 

Init. 

By* 

Invest. 
ID(s ) 6 

Toyota/Lexus Products 

ETC 

Subject 

Result 

1 

2003 

DP 

DP03-003 

MY 1997-2000 Lexus GS and LS 

Y 

Unintended Engine Speed 
Increase/Sudden Acceleration 

Denied 7 

2 

2004 

DP & 

ODI 

DP04-003 

PE04-021 

MY 2002-2003 Toyota Camry and 
Lexus ES300 

Y 

Electronic Throttle Control System 

Granted Closed 

3 

2005 

DP 

DP05-002 

MY 2002-2005 Toyota Camry and 
Lexus ES300/330 

Y 

Uncontrollable Accelerations Due 

to ETC 

Denied 8 

4 

2006 

DP 

DP06-003 

MY 2002-2006 Toyota Camry and 
Solara 

Y 

Engine Surging 

Denied 9 

5 

2007 

ODI 

PE07- 

016 10 

EA08-010 

MY 2007-2008 Lexus ES350 and 
Toyota Camry 

Y 

Pedal Entrapment, Accessory All- 
Weather Floor Mat 

Recall 

07E-082 * 11 

6 

2008 

ODI 

PE08-025 

EA08-014 

MY 2004 Toyota Sienna 

N 

Pedal Entrapment, Interior Trim 
Panel 

Recall 

09V-023 12 

7 

2008 

DP 

DP08-001 

MY 2006-2007 Toyota Tacoma 

Y 

Sudden/Uncontrolled Acceleration 

Denied 13 

8 

2009 

DP 

DP09-001 

MY 2002-2003 Lexus ES300 and 

MY 2007 ES350 

Y 

Unwanted/Unintended 

Acceleration 

Denied 14 


*- ODI indicates action initiated by internal evaluation, DP indicates initiation at request of outside party. 


6 Additional details of each action can be found at http://www-odi.nhtsa.dot.gov/defects/ by searching for the investigation ID. 

7 See 68 FR 55076 

8 See 71 FR 164 

9 See 72 FR 10815 

10 The PE, or preliminary evaluation, is the initial opening action which was subsequently upgraded to an EA, or an engineering analysis. 

11 See http://www-odi.nhtsa.dot.gov/recalls/recallsearch.cfm , search for 07E082 

12 See http://www-odi.nhtsa.dot.gov/recalls/recallsearch.cfm , search for 08V023 

13 See 73 FR 51551 

14 See 74 FR 56686 
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The first investigative action, opened in 2003, was initiated at the request of a petitioner who 
owned a 1999 Lexus LS400 who experienced three occurrences of UA allegedly occurring when 
the accelerator pedal was not applied, one of which resulted in a low-speed crash (for which the 
petitioner received a traffic citation). The petitioner cited other VOQ reports as evidence of a 
defect. ODI conducted a VOQ-based assessment of UA rates on the subject Lexus in 
comparison to two peer vehicles and concluded the Lexus LS400t vehicles were not over¬ 
represented in the VOQ database. Accordingly the petition was denied; a Federal Register notice 
detailing the agency’s analysis was published. 15 

In late 2003, NHTSA conducted a pre-investigative assessment 16 on the MY 2002-2003 Toyota 
Camry based on its review of vehicle owner complaints alleging UA in these ETC-equipped 
vehicles. One of several changes incorporated in MY 2002 Camry revisions was the 
implementation of ETC, which was highlighted in the ODI analysis as a potential area of 
concern. The initial evaluation (conducted by an ODI engineer with a graduate degree in 
electrical engineering) cited 38 VOQs as potentially involving an ETC problem. Shortly 
thereafter, in early 2004, ODI also received and reviewed a DP involving UA concerns on MY 
2002-2003 Lexus ES300, so-called sister vehicles to the Camry model that share the same ETC 

17 . 

system. The petitioner alleged an ETC malfunction caused a low speed crash while parking 
and cited 37 additional VOQs as evidence of a possible defect in the ETC system. During its 

review ODI eliminated from its further consideration 34 of the reports cited by the petitioner on 

1 8 

the basis that they involved minor UA incidents more characteristic of a drivability concern 
than a safety defect. 

Given its concern for consumer safety and the relatively new but increasingly common use of 
ETC technology, the agency opened an investigation in March 2004, to assess whether the ETC 
system may have been the cause of the apparent increase in the number of UA reports. The 
launching of the investigation was widely publicized by media outlets resulting in a significant 
increase in consumer complaints alleging UA affecting not only the subject but other vehicle 


15 See 68 FR 55076. 

16 ODI refers to these analyses as an Initial Evaluation, or a “package,” in this case IE03-072. 

17 ODI staff met with the petitioner and visited the site of the crash, a parking lot located in Rockville, MD, test 
drove the Petitioner’s vehicle, and reviewed its service history. No evidence as to causation was found. 

18 “Drivability” refers to vehicle characteristics that may cause some level of concern to the driver but generally do 
not involve a safety issue, such as very short duration hesitation while accelerating. 
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models as well, including some which did not contain an ETC system. During the investigation 
ODI determined from interviews that many of the VOQ reports could not be explained by a 
failure of the ETC system in that the circumstances drivers described (significant brake 
application with no braking effect) would have necessitated a failure of the braking system. In 
its post-incident vehicle inspections ODI did not find physical evidence, such as a failed 
component or the recording of a diagnostic failure code, which would support the existence of a 
vehicle-based cause of either an ETC or a brake system failure. 

During the course of the investigation NHTSA gained detailed knowledge of the Toyota ETC 
system’s functionality through technical meetings held with Toyota’s system engineers and from 
additional information obtained from Toyota, much of which is proprietary or otherwise 
confidential in nature and, therefore, pursuant to Federal law and regulation, could not be 
publicly released by NHTSA. This knowledge, along with the absence of physical evidence of 
an ETC system failure and NHTSA’s prior experience investigating UA, including application of 
the principles stated in the 1989 report “An Examination of Sudden Acceleration,” 19 led the 
agency to conclude that the incidents being described in the VOQ reports were not being caused 
by the ETC system. Accordingly, the investigation was closed in July 2004 without further 
action. 

NHTSA’s 2004 determination did not settle the matter, as evidenced by the defect petitions 
submitted in 2005, 2006, 2008, and 2009 requesting that the agency investigate the Toyota ETC 
system as the cause of UA incidents. Although each petition had variations on the products 
involved and alleged somewhat different forms of UA manifestations and concerns, all four cited 
the high number of UA-related VOQ reports as a basis for the request, suggesting that the 
number of VOQ reports in itself was evidence of an underlying ETC defect.' NHTSA reviewed 
each petition request thoroughly, including meeting with and inspecting each petitioner’s 
vehicle, conducting hundreds of interviews of the drivers involved in the cited reports, sending 
information request letters to Toyota and thoroughly reviewing the responses provided, having a 
supplier conduct destructive testing of a suspect component removed from a petitioner’s vehicle, 
and holding meetings with Toyota on the technical issues. At the conclusion of these actions, 

19 Full report available at http://www.volpe.dot.gov/hf/docs/sudaccel.pdf . 

20 Additional media reports for each action led to additional VOQ reports being fded, although at a lower level than 
publicity effects seen in 2004, thus further adding to the volume of Toyota UA reports. 
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ODI denied three of the petitions on the basis that the evidence supporting an ETC-related defect 
was not present. ODI denied the 2009 petition on the basis of Toyota’s announcement of Safety 
Recall 09V-388 to address pedal entrapment issues, which in ODI’s assessment addressed the 
issue reported by the petitioner. Federal Register notices (cited in the footnotes accompanying 
Table 1, above) were published for each action. 

During this period, ODI diligently reviewed and, as warranted, investigated UA reports 
involving Toyota products, as evidenced by the opening of the 2007 and 2008 investigations 
(described below), both of which were initiated as a result of ODI assessments, and both of 
which resulted in a safety recall. The 2007 action was opened in March 2007, only a few months 
after the subject vehicles were introduced into the U.S. market, and NHTSA opened the action 
based on only five VOQs alleging the UA concern. 

Whereas the reports studied in the 2004 action (and the related petitions) commonly alleged 

vehicle self-acceleration during low speed driving (typically while parking) after which the 

vehicle returned to nonnal operation, the reports associated with the 2007 investigation 

concerning the 2007 Lexus differed significantly. In fact many of these reports differed from 

any other UA report ever received by NFITSA. In these VOQs the complainants reported they 

had intentionally applied the accelerator to increase vehicle speed after which the vehicle 

continued to produce maximum power even though they had removed their foot from the 

accelerator. In some cases the incidents continued at high speeds for several minutes and miles 

apparently because drivers unfamiliar with the operation of the keyless (push button) ignition 

system, or how to shift the vehicle to neutral, could not bring the vehicle under control. The 

common thread ODI discovered in these incidents was the apparent use of an unsecured all- 

weather floor mat supplied by Toyota at its dealerships that was so constructed that, when out of 

21 

position, it could entrap a fully depressed accelerator pedal. 

Due to the level of severity of the incidents being experienced NHTSA requested that Toyota 
conduct a safety recall of those mats even though the cause of the incidents was detennined to be 

21 Entrapment was caused by a mechanical interference of the accelerator pedal with a groove of the rubber all- 
weather floor mat, as described in VRTC Memorandum Report EA07-010-VRTC-DCD7113, 2007 Lexus ES350 
Unintended Acceleration; http://www-odi.nhtsa.dot.gov/acms/docservlet/Artemis/Public/Pursuits/2007/EA/INFR- 
EA07010-28888.pdf . In this case, entrapment involves the mat being in a position under the bottom of the 
accelerator, making the entrapment difficult for the driver to perceive quickly. In other scenarios, pedals can be 
entrapped by mats or other objects being on top of them. 
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mis-installed (double stacked and/or unsecured) all-weather floor mats trapping the accelerator 
pedal in the full-open position."' In the recall action (07E-082), which covered the all-weather 
floor mats sold for use in the MY 2007-2008 Camry and Lexus vehicles, Toyota provided a 
redesigned all-weather floor mat that substantially reduced the chance of an entrapment even 
when it was not properly installed. At the time of the recall announcement Toyota issued notices 
to dealers and vehicle owners regarding the dangers of the floor mats and the actions to take 
should an entrapment occur, and NHTSA issued a similar media release, noting that the dangers 
of pedal entrapment by unsecured floor mats exist in many vehicles. 

The 2008 action (09V-023), which involved the Toyota Sienna minivan and was opened based 
on one VOQ report and one non-dealer (Toyota) field report, also involved an entrapment issue. 
In this case a trim panel on the center console could trap the accelerator in a partially open 
position if the retaining device (a plastic pin sometimes referred to as a Christmas tree), that was 
intended to secure the panel was missing. The pin was believed to have been present at the time 
of vehicle manufacture. However if the pin was not reinstalled during a subsequent service 
procedure a hazard could result. Toyota’s recall replaced the trim panel with one that could not 

93 

interfere with the accelerator even if the retaining clip was missing. 

1.2 Other UA Related Toyota Recalls 

Toyota has recently conducted two other recalls involving UA concerns, one for an additional 
pedal entrapment concern not addressed in the 2007 floor mat recall, and one for a “sticky pedal” 
condition. ODI was preparing to open investigations in both these situations and strongly urged 
Toyota to move quickly. Toyota announced the recalls before ODI had opened fonnal 
investigations in either case. 

1.2.1 Pedal Entrapment Recall 

On August 28, 2009, a fatal crash occurred near San Diego, California. Shortly thereafter the 
incident was investigated by NHTSA and the San Diego County Sheriffs Department. Evidence 
at the crash site showed that an unsecured and incompatible all-weather floor mat was thermally 
fused to the bottom edge of the accelerator pedal in a position known to cause unwanted 

~ 2 When the floor mat is properly secured on the retaining hooks it cannot interfere with the accelerator pedal. The 
retention hooks are not tall enough to secure two or more stacked mats. 

23 Toyota conducted two other recalls for UA concerns since calendar year 2000. One recall was 06V-253, the other 
was 05V-565, and both involved accelerator pedal entrapment concerns from nearby components. 
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acceleration. 24 The vehicle was a Lexus ES350 that a dealer had provided to the consumer as a 
loaner vehicle. However, the suspect floor mat was designed for a Lexus RX SUV and was 
longer (longitudinally) than the mat that would have been proper for the Lexus ES350. At the 
time NHTSA investigators viewed the wreckage, the accelerator pedal was still fused to the floor 
mat, apparently melted in that position by the heat of the fire that followed the crash. Combining 
this observation with the circumstances known to have occurred immediately prior to the crash, 
including extremely high speeds and the driver’s inability to control the speed,' NHTSA 
concluded that the excessive speed was caused by pedal entrapment. The San Diego County 
Sheriffs Department shared this view. 26 Supporting this conclusion was the fact that another 
customer of the dealership had used the same vehicle just three days earlier and complained of 
unintended, high-speed acceleration caused by the pedal having been trapped by the mat until he 
was able to stop the acceleration by freeing the pedal from the mat. 

The San Diego tragedy made clear to NHTSA that the entrapment problem could occur in 
unexpected ways and that recalling the mats and educating drivers and dealers about not using 
unsecured, improper, or stacked mats was not going to adequately address the risk. As a 
consequence, NHTSA began to explore additional remedial options focusing primarily on the 
pedal design of a number of Toyota vehicles, not because of any kn own malfunction in their 
operation but because their shape, and the manner in which they interacted with the floor board, 
tended to make pedal entrapment more likely. 

As NHTSA prepared to open an investigation on the pedal design it infonned Toyota that the 
company needed to address this risk promptly as a vehicle defect issue, and requested that 
Toyota conduct a recall. Toyota responded to NHTSA by announcing a recall (09V-388) to 
replace or reshape the pedals in 3.8 million vehicles and sent its official notice of the recall to 
NHTSA on October 5, 2009. NHTSA also pressed the company to include a brake override 


24 NHTSA vehicle inspection: http://www- 

odi.nhtsa.dot.gov/acms/docservlet/Artemis/Public/Pursuits/2Q09/DP/INME-DP09001-3721 lP.pdf 

25 NHTSA’s inspection found that the brake pads, rotors, and calipers were extremely heat damaged from the 
driver’s efforts to stop the vehicle during the incident. 

See San Diego County Sheriffs Department Incident Report concerning August 2009 crash in Santee, California 
(Case No. 09056454). 
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system (BOS) on models that have keyless ignition systems as part of its recall. - BOS is a 
safety feature that gives priority to the signal from the brake pedal and returns the engine to idle 
when it detects the brake and accelerator being simultaneously applied. After further discussion 
between NHTSA and Toyota concerning the scope of the recall, Toyota expanded the pedal 
entrapment recall to include an additional 1.1 million vehicles, submitting the notice to NHTSA 
on January 27, 2010 (10V-023). 

1.2.2 CTS Pedals Sticking 

Unlike the pedal entrapment recall, this recall (10V-017) involves the internal working of the 
pedal assembly. (The affected pedals are manufactured by CTS Corporation, which is based in 
Elkhart, Indiana.) Another distinguishing factor is that the pedal entrapment situations involve 
instances of full acceleration that are initially intended by the driver, while this problem 
generally involves occurrences at lower power levels where the car continues to accelerate 
because the pedal does not return fully, or returns slowly, when the driver lessens pressure on the 
pedal. Some Toyota vehicle owners have complained of certain symptoms in vehicles equipped 
with those pedals. Those symptoms include a feeling that it is harder than nonnal to depress the 
pedal or that, when depressed, it is slower to return. In some circumstances, the situation can 
involve the pedal not returning at all from the position to which it was depressed. The problem 
is mechanical in nature and does not involve a flaw in the electronic signal being sent from the 
pedal sensor to the throttle. 

In November 2009, NHTSA received several Toyota field reports concerning incidents in which 
pedals were slow to return or sticking in a number of different Toyota models from various 
model years. NHTSA reviewed those reports as part of its screening for possible defect trends. 
However, before NHTSA had decided whether or not to open an investigation, Toyota contacted 
the agency in January 2010 about the specific problem it had identified with the CTS pedal. At 
the agency’s insistence, Toyota met with NHTSA technical staff and leadership to review and 
demonstrate the problem with the CTS pedals. Based on the infonnation presented, NHTSA told 
the company it expected very prompt action. Two days later, on January 21, Toyota announced 
the recall, covering some 2.3 million vehicles (many of which are also covered by the pedal 

~ 7 Although NHTSA often provides suggestions, the recall remedy is ultimately determined by the company. In this 
case, the company did include BOS in the remedy for the vehicles equipped with keyless ignitions but not for those 
with traditional, keyed ignition systems. 
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entrapment recall and will receive both remedies). Toyota had the supplier produce a new pedal 
design that addressed the issue of excessive friction which caused the “sticky pedal” and also 
devised an interim remedy to eliminate the safety risk by altering the pedal while new ones are 
being manufactured. To date NHTSA has identified only one VOQ report it believes involves 
this condition, although other VOQ reports may involve the “sticky pedal” defect. 

1.2.3 Recall Query 

On February 16, 2010, NHTSA opened a recall query (RQ 10-003) to determine whether the 
scope of the pedal entrapment and sticky pedal recalls was sufficiently broad to include all of the 
vehicles subject to these defects and to address all vehicle-based causes of UA known to Toyota. 
NHTSA obtained tens of thousands of documents from the company and has examined them 
carefully. Some of the information obtained in this inquiry has been useful in preparing this 
report, particularly information on warranty repairs. NHTSA’s examination of the voluminous 
data did not reveal any previously unknown potential causes of UA. 

1.3 Congressional Hearings 

The January 2010 recalls brought the total number of Toyota vehicles recalled for UA-related 
issues in just four months above seven million and led to enormous media and Congressional 
interest. In the next four months, Congressional committees held seven hearings on the recalls, 
unintended acceleration, NHTSA’s defects investigation program, and related legislative 
proposals. Witnesses at some of the hearings indicated that they believed that some kind of 
electronic defect was responsible for UA in Toyota vehicles and that their ETC systems may be 
susceptible to electromagnetic interference (EMI). One witness described experiments he had 
done in which the introduction of certain faults produced UA in some Toyota vehicles. Some 
witnesses questioned whether NHTSA had the expertise to find electronic defects or sufficient 
investigative resources to address possible defects in the nation’s large vehicle fleet. 

As discussed above, NHTSA’s previous investigations had not revealed a defect in the Toyota 
ETC system but had revealed other problems related to UA that had led to recalls. When the 
Secretary of Transportation and NHTSA Administrator appeared at these hearings, they made 
clear that NHTSA would conduct further, in-depth studies to detennine whether the Toyota ETC 

28 Professor Gilbert of Southern Illinois University 
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system may have a defect and whether electronic control systems in other vehicles may be 
susceptible to safety-related defects. 

1.4 NHTSA Initiatives 

In March 2010, NHTSA launched two major studies designed to answer questions surrounding 
the issue of UA. The first was an in-depth examination of whether Toyota’s ETC system 
contained possible defects that could be causing UA. For this study, NHTSA retained the 
National Aeronautics and Space Administration (NASA), an organization with established 
expertise in electronics, systems analysis, and software, to assist in and support its examination 
of the Toyota ETC system. For the longer tenn, the agency sought recommendations from the 
National Academy of Sciences (NAS) on the nature and extent of UA and safety issues related to 
electronic vehicle controls generally. 

1.5 Study of Toyota’s ETC System and UA Potential 

NHTSA’s study of Toyota’s ETC system, which was supported in large part by NASA’s work, 
was designed to obtain a more in-depth understanding of that system and possible safety 
vulnerabilities that could lead to UA. This critical information would provide the basis for an 
agency decision on whether to initiate a new defect investigation or other action concerning the 
ETC system. NASA’s Engineering and Safety Center (NESC) has widely recognized expertise 
in the full range of engineering disciplines, problem solving experience, and a systems 
engineering focus. In addition to requesting a thorough examination of the ETC system and its 
possible vulnerabilities, the agency also asked NASA to detennine whether any vulnerabilities 
identified through its work could realistically be expected to occur in a consumer’s use of the 
vehicles (i.e., in the real world). 

NASA’s examination of the Toyota ETC system is detailed in NASA’s companion report, issued 
simultaneously with this report. That report constitutes the most in-depth examination of a 
motor vehicle manufacturer’s electronic control system ever conducted by a government agency. 
A summary of NASA’s findings, observations, and recommendations appears below. 

1.6 NAS Study 

At the same time it was working with NASA to begin the study of Toyota’s ETC system, 
NHTSA enlisted the National Academy of Sciences (NAS) to study broader questions. NHTSA 
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asked NAS to assemble an independent panel of experts to study the causes and solutions for UA 
generally. NHTSA also asked NAS to look carefully at the range of electronic control systems 
in today’s vehicles and the strategies manufacturers are using to ensure their safety. NHTSA 
asked the panel for recommendations in these areas in terms of research, rulemaking, or 
enforcement activities and on the resources the agency needs to address any areas of concern. 
NHTSA expects to receive the NAS recommendations in the fall of 2011. 

2.0 STUDY OF TOYOTA’S ETC SYSTEM AND UA POTENTIAL: 
NHTSA’S ACTIVITIES 

2.1 Purpose 

As explained above, NHTSA retained NASA to study the Toyota ETC system and has been 
working very closely with NASA on the project. At the same time, NHTSA embarked on 
additional activities to facilitate resolution of concerns about UA incidents in Toyota vehicles. 
NHTSA conducted a thorough examination of relevant complaint data to help detennine the 
problem’s scope. NHTSA also analyzed Toyota warranty data to detennine whether there was 
evidence of any trends suggesting a problem related to the ETC system or components. The 
agency also examined data from Toyota field inspections related to possible UA incidents. 
NHTSA conducted a series of field inspections of Toyota vehicles alleged to be involved in 
recent UA incidents to detennine whether they might reveal evidence of a vehicle-based defect. 
NHTSA also obtained a number of vehicles involved in alleged UA incidents and similar 
vehicles not engaged in such incidents to permit detailed examination of actual vehicles for any 
evidence of possible defects that might be causing UA, whether mechanical or electrical. 

The combined NHTSA and NASA work was intended to provide NHTSA with the information it 
needed to determine what additional steps may be necessary to identify the causes of UA in 
Toyota vehicles and determine whether a previously unknown electronic defect may be present 
in those vehicles and warrant a defect investigation. We believe the combined work has 
accomplished those purposes. 
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2.2 Review of Consumer Complaint Data 


2.2.1 Consumer Complaints to NHTSA 

NHTSA received more than 38,000 owner complaints (also referred to as Vehicle Owner 
Questionnaires, or VOQs) during 2009 and over 65,000 in 2010, through the Auto Safety 
Hotline, its web site, and the US mail. As explained below, the huge increase in the 
complaint volume in 2010 was apparently related to the publicity concerning the UA issue, 
which affected the rate of complaints on UA and non-UA issues as well as complaints 
concerning non-Toyota products. The complaint information, which is voluntarily provided by 
consumers (who often lack expertise in automotive technology), is entered into the NHTSA 
consumer complaint database, and catalogued according to vehicle or equipment make, model, 
model year, and the affected part (component description), assembly, or system as identified by 
the consumer. 31 Complaint data are available as-received 32 on NHTSA’s web site for all to 
review. NHTSA technical staff read each complaint as it is received as part of a continuous 
review to identify potential trends that may indicate the presence of an emerging safety defect. 
The same data are also used to support existing safety defect investigations. When appropriate, 
NHTSA technical staff will conduct follow-up interviews and sometimes field visits to verify 
complaints that point to possible safety defect concerns. 

2.2.2 Identifying Complaints Related to UA 

Consumer complaints to NHTSA often allege certain conditions that may not be attributed to a 
specific vehicle component. “Unintended Acceleration” (UA) is one such condition. As alleged 
in consumer complaints to NHTSA, UA applies to a wide variety of conditions that include: 

1. Engine idle fluctuations; 

2. Unexpected but modest increases of engine power while driving; 

3. Cruise control behavior; 

4. Incidents in parking lots where vehicles unexpectedly accelerate; and 

5. On-road prolonged high-speed incidents. 

29 (888) 327-4236 

30 http://www.safercar.gov/ . 

31 Over 80% of complaints received in the last year are filed directly by the consumer on NHTSA’s web site. 

’ 2 Personal identifiers protected by the Privacy Act and profanity are removed from the narratives. 
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Each of these incidents may be caused by design characteristics of the vehicle, driver behavior, 
vehicle mechanical conditions (such as floor mats, sticky pedals, or others), or potential 
malfunctions in the engine/transmission systems and their controlling electronics. Many UA 
complaints received by NHTSA (and in fact the majority of those that occur at low initiation 
speeds and involve high power) also mention that the brakes were ineffective in stopping or 
slowing down the vehicle. 

Consumer complaints are not marked with any type of condition code to designate the ones that 
involve or allege UA. UA incidents cannot be reliably identified by a particular vehicle 
component code in the database because those codes are typically assigned by the complainant 
(who may or may not choose an appropriate code) and because they also correspond to non-UA 
conditions such as stalling and hesitation. Accordingly, NHTSA made use of a keyword search 
of the VOQ complaint narrative field to identify a statistically relevant (and sufficiently large) 
sample of complaints alleging the broadest possible range of UA concerns, and that were 
received over the last decade. NHTSA’s search criteria were intentionally very broad so as to 
identify as many relevant complaints as possible and, as a result, swept in complaints that did not 
involve UA. 34 Therefore, a careful reading of each complaint was required to clarify whether or 
not it actually involved a UA incident. 

NHTSA embarked on this study early in 20 1 0. 35 From January 1, 2000, to March 5, 2010, 36 
NHTSA received over 400,000 complaints of all types (Table 2). Of this total, over 19,000 met 
the UA keyword search criteria. These complaints were manually reviewed to assess whether a 
UA incident was alleged. Further review of each report identified certain objective infonnation 
from the narrative, such as initiation speed, or the location where the incident occurred. And 
when factual infonnation was sparse, inferences about the conditions present at the time of the 


33 Keyword search overview and terms available in Report No. NHTSA-NVS-2011-ETC-SR01. 

34 The keyword search also identified various unrelated conditions such as vehicle drivability/hesitation and ABS 
braking concerns that were not UA related. 

35 The output of NHTSA’s work was required to commence the NASA assessment. 

36 NHTSA’s detailed analysis of complaint data covers this decade-long time period, a cut-off chosen when the 
analysis began early in 2010. Of course, NHTSA has continued to review and analyze complaints received since the 
end of this period, and discusses some of those complaints in this report, but did not incorporate the newer 
complaints into this analysis except to show broad trends through the end of 2010. 
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incident were made based on the context described in the narrative. This process revealed 
approximately 9,700 UA-Related Complaints for all model years (MY) 1998-2010 vehicles, of 

TO 

which approximately 3,000 were Toyota vehicles. 


Table 2: Identification of Likely Toyota UA VOQs 


Category 

No. of VOQs 

Total VOQs received from 1/1/2000 to 3/5/2010 

426,911 

UA related VOQs ID'd by key-word search 

19,269 

VOQs remaining after manual review 

11,454 

MY1998-MY2010 - only 

9,701 

Toyota- only 

3,054 


This body of complaints underwent further review that will be discussed in later sections. The 
review included targeted follow-up interviews of the complainants, cross-checking against other 
data sets, and decisions as to the appropriate category for each complaint. 

2.2.3 Timing of Toyota Complaints: The Effects of Publicity 

NHTSA assumes that not all incidents are reported and that, accordingly, each complaint 
represents a greater number of unreported real-world failures. All things being equal, the ratio of 
complaints to these failures is expected to remain constant. An emerging safety defect will 
increase the number of real-world failures, raising the number of complaints without altering the 
ratio. Other factors such as publicity, which can alert people to both a specific possible safety 
issue and to the option of filing a complaint with NHTSA, can produce significant complaint 
volumes without indicating a corresponding increase in the number of real-world failures. 


37 For example, if the location was not explicitly identified but a narrative indicated that the vehicle was in Reverse 
at the time of the incident, the initiation speed was low, and the vehicle was not in traffic, the vehicle was likely 
conducting a parking maneuver. 

38 NHTSA’s keyword search, although broad enough to identify VOQs that did not involve UA, also did not 
identify every UA VOQ present in the database. For the reasons discussed in the text above, in its primary search 
NHTSA did not use the component code as a search criterion due to its lack of precision in a context as broad as 
UA. However, to double check, NHTSA did a separate, even broader review of the VOQ database for reports 
alleging UA using the component code category as a search criterion. That assessment, which focused primarily on 
reports involving the Vehicle Speed Control component code and Camry vehicles, identified an additional 381 MY 
1998 to 2010 Camry VOQs, of which 235 did not allege a UA incident. NHTSA’s review of the remaining 146 
Camry VOQs determined that the additional reports largely mirrored the same distribution among incident types as 
those identified from the keyword search and that their incorporation into the analysis would have a negligible 
impact on its outcome. Therefore, those 146 reports are not included in the analysis of Camry discussed in this 
section. 
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For example, NHTSA’s complaint volume spiked in March 2004, (after four months of pre- 
investigative screening of the problem) when NHTSA opened an investigation (PE04-021) of 
electronic throttle control concerns in the 2002-2003 Camry, Solara, and ES300 (Figure 1). 
However, it is unlikely that this spike was caused by a sudden increase of the in-field failures at 
that time. Rather, the spike was likely related to publicity surrounding the opening of the 
investigation. Complaints also ramped up starting in September 2009, through the end of March 
2010. Publicized events during this time period included the fatal ES350 crash near San Diego, 
California in late August of 2009, announcement of a safety recall involving the accelerator 
pedal being entrapped by out of position floor mats (Safety Recall 09V388) in early October, an 
expansion of the October recall and announcement of a new recall for a “sticky pedal” defect in 
January 2010, and the early 2010 Congressional hearings. A majority (71%) of the complaints 
presented in Figure 1 were reported after the announcement of the pedal entrapment recall in 
October 2009, with almost half (43%) received in the months of February and March 2010. 


39 The trend is strikingly clear in the subset of these complaints involving fatalities allegedly related to UA in Toyota 
vehicles. (A complete discussion of this subject appears below in the section on complaints alleging fatalities.) In 
the ten years from 2000 until just prior to the October 2009 recall, NHTSA had received 11 such complaints 
involving 15 fatalities, including the four deaths in the August 2009, near San Diego, California. Of those, NHTSA 
has confirmed a vehicle-based cause only in the San Diego crash (pedal entrapment by an improper, unsecured floor 
mat). Note that this same condition was identified in an additional fatal crash examined by NHTSA that was not 
reported as a consumer complaint. By March 5, 2010, (i.e., in just five months) NHTSA had received an additional 
39 complaints involving 45 fatalities possibly related to UA in Toyota vehicles. Half of these recently reported 
incidents dated back over two years, some as far back as 2001. Of the total number (75) of fatal incidents reported 
as of December 31, 2010, nearly a third (22) involved vehicles that were not equipped with ETC. NHTSA has 
obtained additional facts on many of these recently reported incidents but has not yet encountered evidence pointing 
to a vehicle-based cause in any of them. 
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Figure 1: Consumer Complaints to NHTSA Alleging Unintended Acceleration in MY 

1998-2010 Toyota Vehicles 


Although the proportion of complaints concerning UA allegations rose considerably, the 
publicity surrounding certain events substantially increased the flow of complaints to NHTSA in 
all categories, not just UA, as Figure 2 illustrates. Although Toyota vehicles accounted for a 
disproportionate share of the influx of complaints, complaint volumes on vehicles of all major 
manufacturers were affected. 
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Figure 2: Recent VOQ Traffic to NHTSA - UA vs. Non-UA 


The time lag between incidents and complaints about them is also affected by publicity. 
Throughout the past decade, a majority (64%) of complaints (UA and non-UA) were filed within 
a month of the incident’s occurrence. In contrast, during the heightened publicity in early 2010, 
complaints pertaining to recent UA incidents were less than half of the total (42%), and a quarter 
(26%) of UA complaints filed pertained to incidents over a year old. This time lag suggests that 
a major portion of the increased complaints was the reporting of older incidents rather than an 
uptick in new incidents (Figure 3). 
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Figure 3: Recent UA VOQ Traffic to NHTSA - Older Incidents vs. New Incidents 

The important point is that, unlike the actual rate of occurrences in the field, the rate at which 
occurrences are reported to NHTSA may be greatly influenced by intense publicity surrounding 
investigations and recalls. This fact requires careful consideration when drawing conclusions 
based on the sheer volume of complaints received on any subject. Notwithstanding these 
limitations, the consumer complaints are a valuable defect screening tool and play a central role 
in NHTSA’s decisions on whether and when to open an in-depth investigation and, even after a 
publicity spike, specific complaints offer considerable insight into the circumstances surrounding 
the various safety defects investigated by NHTSA. 


2.2.4 Brake Effectiveness as an Element of Complaint Analysis 

NHTSA often conducts interviews with those who report UA incidents to gain understanding, 
from the driver’s perspective, of the level of engine power produced and, if brakes were used, the 
effectiveness of the brakes. Many of the complaints alleging incidents of UA, particularly those 
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involving crashes, report experiencing both high engine power 40 and ineffective brakes. This 
type of allegation has been common both before and since the introduction of ETC. Three 
general factors are identified that may affect brake effectiveness during a UA event: (1) brake 
malfunction; (2) brake fade; or (3) reduced vacuum assist not related to a malfunction. 41 Brake 
malfunction is the only one of these factors that could affect brake effectiveness on the initial 
brake application in a UA event. No evidence of such malfunctions has been found in post¬ 
incident inspections and service of vehicles involved in UA events. The latter two factors are 
believed to have contributed to vehicle control issues in a number of long duration incidents that 
initiated at highway speed, including the only two fatal crashes in which a vehicle-based cause of 
UA has been identified. 42 ’ 43 These mechanisms do not explain allegations of brake 
ineffectiveness in the events that initiate at low speeds, which available evidence indicates are 
most likely caused by the driver pressing the accelerator when intending to apply the brake. 

Brake system malfunctions 

Brake systems are designed to tolerate single faults and maintain braking capability. Single 
point faults that result in complete loss of braking are extremely rare. Component faults that 
could result in circuit failure (e.g., master cylinder seal or brake line) would result in soft brake 
pedal with extended pedal travel and increased stopping distance. Loss of brake vacuum assist 
(e.g., brake booster seal or check valve) would result in a hard brake pedal and require much 
greater brake pedal force from the operator to achieve a given deceleration. If these types of 
failures occurred suddenly, a crash may result. However, each of these conditions involves 
mechanical failures that should be evident on post-vehicle inspection. If such faults existed prior 
to the UA incident, they would have been evident to the driver. There is no known reason for 


40 Some complaints allege that the unintended high engine power occurred after the accelerator pedal had been 
intentionally pressed to the floor (e.g., to pass a slower moving vehicle, merge into highway traffic or maintain 
speed up a grade). When the driver subsequently attempted to decrease throttle, the engine remained at high power 
- which is consistent with a stuck throttle condition. Other complaints allege that engine power increased 
spontaneously, often in response to brake pedal application. 

41 The engine intake manifold is the source of vacuum used by the brake booster to provide power assist. The 
engine manifold produces less vacuum as the throttle is opened from idle. Braking when the throttle is open will 
have full power assist for the first application only. If the brake pedal is “pumped” the booster reserve vacuum will 
be depleted after the first few applications. 

42 California Highway Patrol, Multidisciplinary Accident Investigation Team (MAIT) Report, Case Number BL- 
020-09, August 29, 2009. See also the San Diego County Sheriffs Department Incident Report concerning 
August 2009 crash in Santee, California (Case No. 09056454). | 

43 ODI Unintended Acceleration Investigation - 2007 Toyota Camry - California, Case Number DS07035, Dynamic 
Science, July 2007, ( NHTSA SCI Electronic Case Viewer ). 
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such faults to coincide with a throttle system malfunction. 44 These types of failures would also 
be evident upon post-incident inspection and/or vehicle repair. Analysis of complaints, field 
investigations and warranty data has not identified any UA incidents in which a simultaneous 
brake system failure was a contributing factor. 

Brake fade 

Brake fade is a reduction in braking effectiveness or stopping power that occurs due to friction- 
related thermal effects of repeated and/or sustained brake application, especially in high-speed 
conditions. Post-incident inspections of brake components removed from vehicles involved in 
high-speed, long-duration incidents have revealed evidence of this type of thennal degradation of 
friction materials indicative of prolonged braking at speed (Figures 4 and 5). This type of 
damage has only been observed in incidents that originated at highway speeds and involved 
prolonged open-throttle braking. 45 These types of events were first observed by NHTSA in 2006 
in MY 2007 Lexus ES 350 vehicles 46 and, to date, such brake system overheating in UA 
incidents has only been observed in events involving throttles stuck wide-open due to pedal 
entrapment. 



Figure 4: Left-front inboard brake pad; 2007 Lexus ES350 (ODI 10182245) 


44 Reduced vacuum assist caused by multiple brake applications with the engine operating at a significant throttle 
opening is considered separately. 

45 While the precise initiation point is not always known, these incidents have involved several miles of braking at 
WOT before the event ends by the driver regaining control (e.g., freeing the accelerator pedal, shifting to Neutral, 
turning off the engine) or crashing. 

46 Visit http://www-odi.nhtsa.dot.sov/defects/ to review field investigation memoranda for investigation files PE07- 
016 and EA07-010, or http://www-odi.nhtsa.dot.gov/complaints/ io review consumer complaint and field 
investigation memoranda for ODI complaint numbers 10174732/10176450, 10182245 and 10189655. 
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Figure 5: Left-front inboard brake pad; 2009 Lexus ES350 (ODI 10284881) 

Incidents initiating from stopped or slowly moving vehicles comprise the majority of reported 
UA incidents and an even larger proportion of crashes, particularly for the MY 2002 through 
2006 Camry vehicles that experienced the highest rates of UA complaints and crashes. Since 
these incidents occur at much lower speeds and are much shorter in duration than the high-speed 
incidents associated with pedal entrapment, brake fade is not a plausible explanation for the 
alleged brake ineffectiveness. 47 

“Pumping” the brakes 

Pedal entrapment incidents begin when the driver attempts to release the accelerator pedal after a 
hard application. The vehicles are usually traveling at high speeds on highways with 
surrounding traffic. It may take the driver a few moments to recognize that the throttle is stuck. 
Drivers interviewed by NHTSA have reported using the brake to control vehicle speed in the 
initial moments. Some report pumping the brakes because the brakes appear to be ineffective at 
slowing or stopping the vehicle when initially applied. Braking effort quickly becomes more 
difficult as the reserve vacuum in the brake booster is depleted by the first few pedal applications 
with the throttle fully open. Once the driver subsequently makes the decision to stop the vehicle 
fully, it has been very difficult for drivers to overcome the power of the engine and the kinetic 
energy of the vehicle, which increases exponentially with vehicle speed, particularly for vehicles 
equipped with more powerful engines. The problem is compounded in vehicles with push-button 
ignitions and serpentine shift gates with sequential sport shifting, which have been noted to be 

47 While NHTSA has not conducted testing to determine the conditions necessary to experience brake fade, 
extensive high- and low-speed open-throttle brake testing conducted by NHTSA did not result in any evidence of the 
brake component heat damage observed in the prolonged high-speed incidents. 
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difficult for drivers attempting to turn the engine off or shift to neutral in emergency/panic 
situations. 


The low speed incidents are different in the drivers’ use of controls (accelerator and brake 
pedals) before and after incident initiation. The incidents begin during maneuvers when the 
driver is attempting to slow the vehicle, with many explicitly stating that the UA began when the 
brake pedal was depressed. Review of information contained in complaints, driver interviews 
and field investigations indicates that the driver is attempting to stop the vehicle (or hold it 
stationary in the case of UA involving from stopped vehicles) in the initial application of the 
brake. Only a few drivers have indicated they pumped the brake pedal during these types of UA 
incidents and those that did stated that they did so because the brakes were not effective when 
initially applied. Testing of the Camry vehicles has demonstrated that a normally functioning 
brake system is capable of overcoming full engine power with brake pedal efforts any typical 
driver should be capable of achieving on the initial application. No evidence of brake system 
faults has been noted in owner complaints of UA, warranty claim records or in field 
investigations of UA incidents conducted by NHTSA and Toyota that could explain a loss of 
vacuum assist or other brake system fault coincident with the UA event. There is no plausible 
explanation for brake ineffectiveness upon the initial application in these types of UA incidents. 
Analysis of Electronic Data Recorder (EDR) data collected during field investigations of UA 
incidents with driver claims of sudden full engine power with ineffective brakes have found that 
the brakes were not applied. 

Accordingly, in analyzing UA complaints, NHTSA finds claims of brake ineffectiveness credible 
only in situations involving medium to high initiation speeds and repeated pumping of the brakes 
(which can deplete the vacuum assist) and high speed, long duration events with repeated 
attempts to use the brakes (where brake fade can occur, particularly in high powered vehicles 
with stuck throttles). 


48 No mechanism has been identified that could cause the throttle to open because of brake application and any 
engine power increases that may occur during a brake application should be easily controllable by the driver. 
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2.2.5 Analysis of Alleged UA Complaints 


NHTS A conducted a detailed analysis of complaints that fit a very broad description of UA 
received from January 2000, through March 5, 2010. The analysis focused on distinguishing 
between the circumstances involved in the incidents according to the speed at which the incident 
reportedly began (initiation speed), the location (parking lot, driveway, highway, etc.), whether a 
crash occurred, and the reported or apparent action of the driver. The major insights derived 
from the analysis are that a substantial majority of the incidents begin at a very low speed or a 
stationary position and frequently involve parking maneuvers, and that in most of these types of 
incidents and in many highway incidents the driver claimed or apparently intended to use the 
brake, but any braking that did occur was not effective. These points hold true with great 
consistency when scrutinizing UA incidents across the entire auto industry, just Toyota vehicles, 
or just certain Toyota models. 

Different incident types with very different circumstances, causes, and hazards are included 
within the UA complaints identified. To better differentiate UA incident types, efforts were 
made to classify each complaint by its circumstances according to a single speed range 
(stationary, low, medium, and high) at the time of incident initiation. Table 3 covers the reported 
UA incidents (5,512 out of a total of 9,701 for the whole period) concerning all manufacturers’ 
vehicles in MY 1998-2010 in which detailed review of the VOQ could reliably indicate the 
initiation speed of the incident. 49 The table lists the distribution of complaints, crashes, and 
crash risk (percentage of VOQs involving a crash) by identified initiation speeds. 


49 Some complaint narratives are too ambiguous to reliably support this type of binning. Others cite multiple events 
with dissimilar circumstances. While each complaint was reviewed and considered, the unknowns and multiples 
were not included in these types of tables. 
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Table 3: UA Consumer Complaints by Initiation Speed (All Manufacturers) 


50 


Initiation Speed 

Total VOQs 
(5,512) 

Subset: Crashes 
(2,039) 

Crashes / VOQ 

Stationary 

36% 

33% 

34% 

Low Speed (< 15 mph) 

33% 

51% 

57% 

Medium Speed (15 - 45 mph) 

12% 

9% 

28% 

High Speed (>45 mph) 

19% 

7% 

13% 

Grand Total 

100% 

100% 

37% 


A majority of complaints (69%) and crashes (84%) with known single initiation speeds occurred 
at stationary and low speeds. At the same time, high-speed incidents account for a small portion 
of the total and just 7% of the reported crashes. Further review of the stationary and low speed 
incidents (combined) found that parking space entry and exit accounted for the largest share of 
these incidents (40% of VOQs, 64% of crashes). Many of the parking maneuver narratives 
reported incidents characterized by high engine power either after the driver applied the brake or 
immediately after shifting the transmission. In most cases, the brakes were reported as 
ineffective. These circumstances tend to align with either a pure pedal misapplication (applying 
the accelerator instead of the brake) or dual pedal application (brake and accelerator pedals 
applied). 

Complaints to NFITSA alleging UA and pertaining to Toyota vehicles (3,054 complaints) 
received additional review. Table 4 lists the distribution of complaints, crashes, and crash risk 
by identified initiation speeds for those complaints where that information could be discerned. 


Table 4: UA Consumer Complaints by Initiation Speed (Toyota - Only) 51 


Initiation Speed 

Total VOQs 
(2,244) 

Subset: Crashes 
(1,038) 

Crashes/VOQ 

Stationary 

21% 

19% 

40% 

Low Speed (< 15 mph) 

47% 

65% 

65% 

Medium Speed (15 - 45 mph) 

13% 

10% 

34% 

High Speed (>45 mph) 

19% 

6% 

15% 

Total / Overall 

100% 

100% 

46% 


In numbers almost identical to the industry-wide figures, a significant majority of Toyota UA 
complaints (68%) and reported crashes (85%) occurred at stationary or low initiation speeds. 


50 This table omits 4,189 complaints that involved either undetermined or multiple initiation speeds. 

51 This table omits 810 complaints that involved either undetermined or multiple initiation speeds. 
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High-speed incidents account for a small portion of the total complaints and very small portion 
of the crashes. Parking space entry and exit accounted for half (51%) of the stationary and low 
speed complaints and a majority (70%) of crashes. Within parking maneuvers, parking space 
entry accounted for approximately triple the number of complaints or crashes as parking space 
exits. 

Because the focus of the study was Toyota’s ETC system, and because Canary models accounted 
for the greatest portion of complaints concerning UA models, NHTSA’s complaint analysis 
focused on ETC-equipped Camrys in great detail. MY 2002 was the first year that the Camry 
was equipped with ETC. The MY 2002-2006 Camry model line accounts for just over half 
(57%) of ETC-equipped Camry production and a significant majority of UA complaints and 
crashes (64% and 78%, respectively) concerning ETC-equipped Camry models reported to 
NHTSA. Another new generation of the Camry model was introduced in MY 2007, and the 
study has examined that generation as well, although not in quite the same depth as the first 
generation of ETC vehicles. 

Table 5 lists the distribution of complaints, crashes, and crash risk by identified initiation speeds 
for these ETC-equipped Camry vehicles. 

Tab le 5: UA Consumer Complaints by Initiation Speed (MY 2002-2010 Camry - On ly) 53 


Initiation Speed 

Total VOQs 
(664) 

Subset: Crashes 
(383) 

Crashes/VOQ 

Stationary 

23% 

25% 

61% 

Low Speed (< 15 mph) 

51% 

63% 

72% 

Medium Speed (15 - 45 mph) 

13% 

8% 

37% 

High Speed (>45 mph) 

12% 

3% 

16% 

Total / Overall 

100% 

100% 

58% 


52 

Substantial changes in a vehicle’s design occur from time to time, and manufacturers frequently refer to these 
changes as new platforms, which can be thought of as new generations of the original vehicle. Relevant platform 
changes in the Camry vehicles were introduced for Model Year (MY) 1996, when the V20 platform (which did not 
include ETC) was fielded; MY 2002 (when the V30 platform, which did include ETC, began), and MY 2007 (when 
the V40 platform, also including ETC, began). Because the complaint data reviewed were limited to MY 1998 at 
the oldest, references to the V20 Camry will not cite the earlier model years. In this report then we will refer to 
these different platforms by groupings of the included model years. For example, the V20 platform will be referred 
to as “MY 1998-2001.” 

53 This table omits 184 complaints that involved either undetermined or multiple initiation speeds. 
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The patterns apparent in the data for all manufacturers’ vehicles and Toyota vehicles generally 
hold true for ETC-equipped Camrys as well. A very large majority of complaints (74%) and 
crashes (88%) involve incidents that occurred at stationary or low initiation speeds, and high¬ 
speed incidents accounted for a small portion of the total complaints and just 3% of the reported 
crashes. Further review of the stationary and low speed incidents found that parking space entry 
and exit accounted for over half (58%) of these complaints and a majority (70%) of crashes. 
Within parking maneuvers, parking space entry occurred at over twice the rate of complaints or 
crashes as parking space exits. 

NHTSA’s analysis 54 of the ETC- equipped Camry complaints focused on certain details in 
addition to initiation speed. NHTSA assessed the driver’s stated intent with regard to brake and 
accelerator use, circumstances that implied 55 such use, and reported use of cruise control or 
concerns expressed about the vehicle’s drivability. NHTSA looked carefully at previous 
consumer interviews related to these complaints and conducted a large number of new interviews 
as well. 56 The additional infonnation available and improved office learning throughout the UA 
study enabled additional judgment to be made concerning the scenarios covered by the Camry 
VOQs. VOQs for the three most recent Camry generations (including, for comparative purposes 
the MY 1998-2001 mechanical throttle Camrys) were characterized according to two broad 
initiation speed ranges and reported driver control operation or stated concern (e.g., cruise 
control or drivability) at incident initiation (Table 6). 


54 NHTSA’s complaint analysis focused heavily on incident initiation conditions. NASA conducted its own analysis 
of the same complaint data, more broadly on the Toyota complaints, and then focusing in on the MY 2002 - 2010 
Camry. NASA’s analysis differed in that it strove to assess the apparent power developed by the engine and 
effectiveness of the brakes to align the complaints with a particular degree of throttle opening and then a likely 
throttle control concern. This effort, conducted jointly with NHTSA, added an additional layer of review to the 
ETC- equipped Camry complaints and included conditions reported throughout the incident. Notwithstanding the 
differences in the approaches, the two analyses show similar results. 

55 For example, “Apply Brakes” scenarios were associated with over half (59%) of complaints and a strong majority 
(85%) of crashes involving ETC- equipped Camrys. In these complaints, most (66%) complaint narratives explicitly 
stated that the brakes were applied. Brake use was inferred for the balance by identifying maneuvers cited in the 
narrative that are associated with brake use. These most frequently (22%) involved parking space entry and exit 
maneuvers. Less frequently observed (7%) were driver statements citing maneuvers that would require a brake 
application such as shifting the transmission into Drive or Reverse, creeping the vehicle along in a parking lot, or 
approaches to traffic- controlled intersections. 

56 Over half (57% or 488 / 848) MY 2002 - 2010 Camry VOQs were subject to follow-up effort with 357 leading to 
dialogue with complainants. Half of the interviews pertained to complaints received in 2009 or 2010 (a third in 
2010 only). 
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Table 6: MY 


998-2010 Camry VOQs by Initiation Speed 


Initiation 

Speed 

Scenario / Driver 

Intent 

VOQs 

Crashes 

MY 1998-2001 

MY 2002-2006 

MY 2007-2010 

MY 1998-2001 

MY 2002-2006 

MY 2007-2010 

non-ETC 

ETC 

ETC 

non-ETC 

ETC 

ETC 

(110) 

(544) 

(304) 

(56) 

(341) 

(96) 

Low 

Speeds 
(< 15 mph) 

Apply Brakes 

48% 

69% 

25% 

75% 

85% 

61% 

Apply Accelerator 

12% 

4% 

4% 

4% 

3% 

3% 

Release Accelerator 

5% 






Idle / Normal Operation 

3% 

1% 

3% 




Roadway 
speeds 
(> 15 mph) 

Apply Brakes 

7% 

6% 

7% 

9% 

3% 

9% 

Apply Accelerator 



0.3% 




Release Accelerator 

12% 

3% 

23% 

7% 

1% 

11% 

Cruise Control 

0% 

1% 

5% 




Drivability 

1% 

7% 

23% 




Other/ UNK 

1% 

0% 

1% 

2% 

0% 

1% 

Unknown 

Unknown 

12% 

10% 

10% 

4% 

8% 

14% 

Overall 

100% 

100% 

100% 

100% 

100% 

100% 


Incidents initiating at low speeds (i.e., from a stationary position or at a speed less than 15 MPH) 
in scenarios where the driver was applying the brakes constitute by far the largest overall share 
of complaints and crashes. Complaints throughout this category imply or explicitly state that the 
vehicle accelerated immediately after the brake was applied and generally describe an incident 
that runs its course in seconds and spanned very short distances. Most complaints in this 
category cite only the one incident and state or imply there were no other ongoing drivability 
concerns with the subject vehicle. Only a tiny number (eight) of the complaints in this category 
aligned with ETC warranty claims of any type. The warranty claims and their related complaints 
were scattered over a seven year period and all but one were serviced for non-UA conditions. 
Similar to prior sections, parking maneuvers accounted for over half (61%) of these complaints. 
Pulling into a parking space / stall or garage were by far the most common parking maneuvers 
reported. This category also accounts for an overwhelming majority of crashes experienced 
regardless of whether the vehicle was equipped with ETC. When complaint volumes are 
adjusted for population and field exposure, the two generations of ETC- equipped Camrys show 
comparable complaint and crash rates. 

Roadway speed incidents occurring after rapidly accelerating and then releasing the accelerator 
(e.g., passing a vehicle or merging into traffic) in the MY 2007-2010 Camry constituted the 
second largest share of complaints and crashes for that generation and generally coincided with 
entrapment of the accelerator pedal by the floor or mat, a condition addressed by a safety recall. 
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These complaints generally described longer duration incidents (closer to a minute, in some 
cases longer), multiple attempts to stop the vehicle 57 and, in a few cases, overheated brakes. 
Several complaints specifically stated that the floor mats had interfered with the accelerator 
pedal. 

Incidents beginning at roadway speeds with brake use cited constituted the third largest share of 
complaints with known circumstances and crashes. With the exception of initiation speed, crash 
circumstances were similar to those discussed in the previous section — the incident occurred in a 
situation where the driver intended to apply the brakes (e.g., deceleration with slowing traffic or 
when approaching an intersection). Complaints frequently stated that the vehicle accelerated in 
response to the brake application. Only four of the complaints in this section align with ETC 
warranty claims. In all cases, the warranty claims occurred years prior to or after the incident 
date. 

Vehicle drivability concerns at roadway speeds constituted a major share (23%) of UA 
complaints involving the MY 2007-2010 Camry but caused no crashes, indicating that they 
posed minimal safety consequences. In contrast to many of the other ETC Camry UA complaint 
types, conditions were reported as ongoing, e.g., that the vehicle would frequently hesitate and 
then lurch in response to an accelerator application. These complaints aligned with a number of 
technical service bulletins meant to address phenomena such the tendency of the vehicle to 
“shudder” at a certain speed range due to an intentional transmission design element and engine 
hesitation. 

NHTSA identified four complaints from this period (2000 through March 5, 2010) that appear to 
involve impaired vehicle operation that may be related to the occurrence of a resistive short in 
the pedal position sensor. In one case, NHTSA obtained the pedal and tested it, finding a 
resistive short in the pedal position sensor. NASA subsequently examined the pedal, confirmed 
the existence of the short, and found a “tin whisker” to be the cause of the resistive short. In one 
other case, NHTSA has obtained the pedal and detennined the presence of a resistive short but 
had not determined the mechanism of the short at the time of this report. NHTSA does not have 
access to the removed pedals in any of the other two cases. (Each of the four complaints 

57 Examples of these attempts are: prolonged brake applications, shifting the transmission into Park, turning the 
engine off, removing floor mats from the footwell, and attempting to raise pedals with hands and toes. 
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involved a MY 2002-2006 Camry with potentiometer type pedal sensor) in which the driver 
reported an impaired ability to accelerate (a lack of response to pedal application) combined with 
“jerky” acceleration that made driving difficult, with the engine always returning to idle when 
the pedal was released. Additionally, the vehicles were put into limp-home mode due to the 
occurrence of the short. In these cases, the brakes fully controlled the acceleration and the owner 
brought the car in for servicing, resulting in pedal replacement. These situations are unlike the 
most common allegations of UA in which acceleration allegedly continues even when the 
accelerator is released and, very often, the brakes allegedly have little or no effect. In these 
cases, releasing the accelerator stops the acceleration and the brakes function normally. NHTSA 
and NASA conducted vehicle testing using the same resistive short as found in the failed pedal 
(see NASA’s report for full details). The tests indicated that the fail-safe mode in these vehicles 
does not operate in the same way at all times when this specific condition occurs, and varies 
depending upon how quickly the accelerator pedal is pressed. However, the single short did not 
itself produce a UA condition (which would require the occurrence of a second fault) and, in the 
reported cases, the occurrence of the short resulted in a form of impaired operation that caused 
the driver to seek attention from a dealer, illuminated the malfunction indicator light (“MIL”), 
and stored a DTC in the ECM. These complaints are discussed more fully in the warranty 
section, below. 

In summary, a significant majority of the UA complaint and crash volume (both in Toyota and 
non-Toyota vehicles) is concentrated in high throttle, low initiation speed incidents often called 
“sudden acceleration,” i.e., high power accelerations from a stationary position or very low 

58 

initial speed where the driver claims use of the brake with a loss of braking effectiveness. 


58 The complaint analysis (as well as the analysis of UA complaints alleging fatalities and NHTSA’s field 
inspections conducted in 2010) revealed that older drivers were disproportionately involved in alleged UA incidents. 
NHTSA is concerned about that relationship and is conducting human factor research aimed at identifying causes 
and possible remedial measures. A current study, Pedal Application Errors, reviewed media reports in the United 
States between 2000 and 2010 to identify crashes attributed to unintended acceleration in which the driver 
apparently mistook the accelerator for the brake or that were attributed to unspecified vehicle causes. In addition, a 
panel of Certified Driver Rehabilitation Specialists provided information about medical conditions and other driver 
characteristics that could increase the likelihood of either making a pedal error, or failing to recognize and correct 
such an error. Upcoming project activities will examine older drivers’ pedal behaviors during on-road driving. 
Participants will drive an instrumented vehicle in which posture, leg and foot movements will be recorded. The 
study is designed to provide insight into driver foot movements associated with pedal applications that might 
contribute to pedal errors. Participants will include groups with selected medical conditions, as well as a group of 
normally-aging controls. The study seeks to identify the degree of functional loss associated with each medical 
condition that may increase risk of unintended accelerations. 
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NHTSA believes that these incidents are very likely the result of pedal misapplication. This 
conclusion is based on the fact that application of the brake alone cannot cause acceleration and 
that there is generally no evidence of a vehicle-based cause of the acceleration or of brake failure 
in these incidents. Properly functioning brakes will provide enough force to overcome engine 
torque, even at full throttle, and the conditions that can lead to loss of brake effectiveness (brake 
fade and loss of vacuum) are not relevant to these types of incidents. Moreover, NASA indicates 
in its report that it did not identify any failures in the Toyota ETC system that impacted the 
braking system. Therefore, even if (as appears extremely unlikely), some type of flaw in that 
system caused a UA incident, such a flaw would not be induced by applying the brake or inhibit 
braking. The complainant’s apparently good faith assertion about having applied the brake is 
contradicted by the absence of braking effectiveness, but strongly suggests that the driver was in 
fact applying force to a pedal. NHTSA’s field inspections in 2010, which included examination 
of all aspects of 58 alleged UA crashes, including available Event Data Recorder (EDR) data, 
demonstrated that in nearly every incident of this type where evidence was obtained there was no 
evidence of a vehicle defect, evidence was present of the accelerator being applied, and evidence 
was present of either no braking in the final seconds or braking only in the last second or so. 

(The one exception involved pedal entrapment by a floor mat.) 

Analysis of the medium and high speed incidents involving Camrys revealed that some of those 
complaints concerned claimed brake applications leading to acceleration. Due to the absence of 
any evidence of a vehicle-based defect in these situations and the fact that brake application 
alone cannot cause acceleration, these types of complaints also most likely involve pedal 
misapplication. Here again, NHTSA’s field examination of vehicles in 2010, some of which 
involved incidents at these speeds, supports this analysis of the complaints. Another subset of 
the medium and high speed incidents appeared to involve a stuck accelerator pedal, an issue 
addressed by two major Toyota recalls involving pedal entrapment and sticky pedals. Drivability 
complaints such as idle fluctuation, transmission shift quality, and cruise control behavior 
constitute another significant portion of the complaints but rarely pose discernable safety risks. 
Efforts to link the complaints reviewed here to specific vehicle-based causes through repair 
record review and comparison to large warranty data sets (see below) have not identified vehicle- 
based causes other than those already subject to Toyota’s safety recalls. 
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2.3 Summary of Warranty Data Analysis and NHTSA Technical Assessment of Toyota 

ETCS-i— 


Toyota’s ETCS-i electronic throttle control (ETC) consists of a simplistic electro-mechanical 
hardware system controlled by an electronic control module (ECM) with sophisticated control 
and diagnostic software. In May 2010, NHTSA made a request for warranty data on all ETCS-i 
equipped vehicles sold in the U.S., asking Toyota to provide details for any claim involving, a) 
one of the primary ETC hardware components, the ECM, the throttle actuator, the accelerator 
pedal, and any related wiring or harness connectors, or b) any of the diagnostic trouble codes 
(DTCs) that relate to a potential failure of the hardware or ETC system. Toyota provided its 
response in June 2010, which consisted of nearly 430,000 repair claims on a population of nearly 
16 million vehicles. At the highest level a warranty claim rate of just under 3% was noted. 
However, on further review, over half of the claims were detennined to be related to a 
recognized quality issue involving the Corolla ECM that ultimately resulted in a safety recall 
(10V-384). The hazard involved in that recall was stalling, not ETA. The claim details by part 
group for all ETC models are shown in Table 7 below. 

Table 7: Count of Claims by Part Group, All ETC Vehicles 

1 - Production counts are based Toyota’s EWR submission to NHTSA 


Warranty Claims Counts and Rates 

Part Group 

Claims 

Percent 

Rate 

Engine Control 

Module 

360,545 

84.1% 

2.29% 

Throttle Actuator 

40,608 

9.5% 

0.26% 

Others 

14,734 

3.4% 

0.09% 

Accelerator Pedal 

7,062 

1.6% 

0.05% 

Connectors 

3,338 

0.8% 

0.02% 

Wiring Harnesses 

2,613 

0.6% 

0.02% 

Total: 

Production: 

428.900 

100.0% 

2.72% 

15.743.863 1 


As discussed in the NASA report, the primary focus of the NASA-NHTSA study was the MY 
2002-2006 Camrys which, compared to other Toyota models, were the subject of a greater 
volume of complaints. The MY 2007-2010 Camry was used as a comparator vehicle. 


59 This is a summary of a more detailed analysis NHTSA conducted. The warranty data is withheld subject to a 
pending request for confidentional treatment. 
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Combined, these two generations of ETC-equipped Camrys comprise 3.4 million vehicles (22% 
of the population of vehicles in the warranty data) but yielded about 23,000 claims, a little over 
5% of the total claims. The overall Camry claim rate was 0.7%, a low claim level 
uncharacteristic of that observed in defect investigations involving similar systems or 
components. The Camry claims are summarized by model year in Table 8. 


Table 8: ETC Related Warranty Claims for the Camry Model 



Camry ETC Claim Counts and Rates by Part Group and MY 

Model 

Year 

Vehicle 

Prodct'n 2 

ECM 

Throttle 

Actuator 

Accel. 

Pedal 

Wire 

Conect. 

Wiring 

Harness 

Others' 1 

Totals 

Rate 

Vehicle Platform/Generation 

V30/31 Camry 

2002 

433,112 

2,727 

1,121 

183 

63 

0 

827 

4,921 

1.14% 

2003 

390,691 

4,607 

699 

68 

44 

0 

321 

5,739 

1.47% 

2004 

321,673 

1,369 

1,306 

149 

50 

2 

1,264 

4,140 

1.29% 

2005 

406,091 

804 

1,251 

97 

47 

8 

809 

3,016 

0.74% 

2006 

197,656 

270 

165 

25 

27 

8 

164 

659 

0.33% 

V40 Camry 

2007 

649,461 

1,352 

470 

244 

55 

67 

648 

2,836 

0.44% 

2008 1 

227,177 

188 

99 

90 

20 

19 

166 

582 

0.26% 

2009 1 

447,884 

243 

182 

271 

10 

14 

167 

887 

0.20% 

2010 1 

317,765 

71 

13 

161 

5 

10 

38 

298 

0.09% 


Totals 

3,391,510 

11,631 

5,306 

1,288 3 

321 

128 

4,404 

23,078 

0.68% 



Rate 

0.343% 

0.156% 

0.038% 

0.009% 

0.004% 

0.130% 

0.68% 



Key: — 

contacting type resistive potentiometer position sensors 
non-contacting type Hall Effect based position sensors 



Notes: 1 - MY range may still be within the new-vehicle warranty period 


2 - production counts are based on Toyota's EWR submissions to NHTSA 

3 - ~ 700 claims occurred after January 1, 2010, see detailed report 

4 - some claims coded 'Others' are unrelated to the study, see detailed report 


The ECM experienced the highest level of Camry claim rate by component at 0.3%. However 
NHTSA’s sampled review of the qualitative content of the claim data, the consumer complaint 
description and techncian comments, found that only 2% of the ECM warranty claims appeared 
to relate to ETC system concern. For comparison purposes, a 2009 investigation (EA09-006) 
which involved an ECM for a stability control system experienced warranty rates approaching 
25% (and resulted in a safety recall). For the throttle actuator, which NASA’s assessment 
indicated is unlikely to be a source of UA, the claim rate is lower at 0.2%, while a comparison 
2005 investigation (EA05-021) involving an ETC throttle actuator on Volvo vehicles 
experienced a 25% warranty rate (and resulted in a safety recall). The accelerator pedal claims 
are even lower at 0.04%. A review of the qualitative content for the throttle actuator and pedals 
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primarily showed indications of failsafe operation (discussed below) with little if any evidence 
suggesting the occurrence of UA. The claim trend by model year is declining. NHTSA 
concluded that the warranty data, at rates several orders of magnitude lower than comparable 
investigations, did not indicate the presence of a wide-spread component-based defect trend in 
the Camry products. 

NASA’s analysis of the ETCS-i system identified a potential vulnerability for the accelerator 
pedal signals to be corrupted by outside influences. The pedal signals are analog electrical 
voltages produced by two sensors in the accelerator pedal. The two voltages, known as VPA 
signals (VPA1 and VPA2) vary proportional to pedal position and act as inputs that the ECM 
interprets as the driver’s request for engine power. The ECM monitors the VPA signals to 
determine the proper position for the throttle valve, the device which regulates engine power, 
while also running diagnostic routines intended to identify potential faults. A significant level of 
effort was expended by the NASA-NHTSA team to fully identify and understand the 
vulnerabilities and diagnostic weaknesses surrounding the VPA signals. 

While the hardware configuration is relatively simple the software system is much more 
complex. To perform the normal ETC function of controlling power as well as conducting 
diagnostics the ECM uses complex and sophisticated software algorithms. Learning algorithms 
allow the system to kn ow when the pedal is released or pressed. Threshold tests (high or low 
voltages, signal frequencies, etc.) are used to evaluate signals for validity. Failsafe strategies are 
implemented in response to a detected fault(s). Among other DTCs, the Camry ETC system uses 
eight (8) diagnostic monitors that evaluate the VPA signals and produce a trouble code when a 
fault is detennined, one for each monitor. At detection, the ECM stores the DTC in memory, 
illuminates a malfunction indication lamp (MIL) on the instrument panel, and implements a 
failsafe mode. Toyota uses two failsafe strategies for the VPA signals. One failsafe that occurs 
when a single VPA signal fails (the other signal is used redundantly), which is referred to as the 
’’limp home” mode, results in a limited throttle opening (15 degrees above idle) and a brake 
override strategy that returns the engine to idle whenever the brake is applied; the vehicle 
remains drivable, although at diminished power. The second failsafe, the "at idle” mode, occurs 
when both VPA signals are lost. In this mode the engine remains at idle always, effectively 
disabling the vehicle. 
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NHTSA reviewed the warranty data to evaluate the claims indicating the presence of ETC- 
related diagnostic codes, paying particular attention to those that involved the VPA signals. In 
total 404 claims involving 465 DTCs related to the pedal signals were found, as shown in Table 
9. Although occurring at a very low rate (14 DTCs/100,000 vehicles), lower than the component 
replacement rates above, NHTSA noted that 332 of the claims involved one particular diagnostic 
code (P2121 60 ), one of the more complex diagnostic routines that monitors correlation of the two 
VPA signals. For Camry, the MY 2002-2006 vehicles use a potentiometer type pedal sensor, 
while the MY 2007-2010 Camry models use a Hall Effect type sensor. Three hundred and ten 
(310) of the P2121 DTCs involved the potentiometer type sensor, 22 for the Hall Effect sensors. 
The two sensor types have different electrical characteristics that cause them to behave 
differently in the presence of certain faults, and accordingly NASA and NHTSA evaluated each 
in significant detail. 


Table 9: Accelerator Pedal Related DTC Counts and Rates Code and MY 


Camry Accelerator Pedal Related DTC Claim Counts by DTC Codes and MY 

- - —------ h - 1 ■■■■■■ 


MY 

Ptodct'n 

PUZO 

PI 171 

PZ170 

P71Z1 

P71ZZ 

PZ173 

P712S 

P2177 

P7178 

P71M 

VotaH 

Rate/ 

1006 

7007 

4JJ.11? 

17 

136 

1 

0 

0 

0 

O 

0 

0 

O 

1S4 

3S.S6 | 

2001 

390,691 

0 

4 

1 

12 

2 

0 

0 

4 

4 

1 

78 

7.17 

200 « 

»1,6?J 

0 

3 

3 

92 

23 

0 

0 

3 

20 

3 

1S1 

46.94 

ZOOS 

406.091 

0 

3 

3 

32 

8 

0 

1 

5 

3 

2 

79 

19.4S 

70Q6 

19?,656 

0 

0 

0 

8 

4 

0 

1 

3 

0 

0 

16 

8.09 | 

zoo; 

649.461 

0 

0 

0 

10 

0 

0 

1 

0 

1 

1 

13 

2.00 | 

zoo* 

?2?,1?? 

0 

0 

1 

4 

2 

0 

1 

0 

0 

0 

• 

3.52 

2009 

44?,904 

0 

0 

0 

6 

1 

0 

2 

2 

1 

0 

12 

2.68 

2010 

31?.?65 

0 

0 

0 

2 

2 

0 

0 

0 

0 

0 

4 

1.Z6 

lotah 

i.m.sio 

17 

146 

9 

186 

44 

0 

6 

i; 

31 

9 

465 

13.71 


RMe/10M 

o.so 

4,30 

0.27 

S.48 

1.30 

0.00 

0.18 

o.so 

0.91 

0.27 

13.71 



Contacting resistive pot sensors end Phase i software (only two P codes used) 
Codes not available m Phase i software {Phase li software only) 

Contacting resistive pot sensors and Phase il software 
Non-contactmg Hall Effect sensors and Phase it software 



For the potentiometer equipped vehicles a review of Toyota data (warranty return analysis) and a 
failed pedal assembly obtained from a VOQ complainant (ODI 10304268) identified a failure 
mechanism affecting the VPA signals. To date, four such failures have been identified, two by 
Toyota, and two by the NASA-NHTSA team. The failures were produced by the formation of a 
tin whisker between tin plated electrical conductors within the sensor housing. Tin whiskers are 
one example of a group of resistive fault failure mechanisms that can introduce partial 
resistances and/or partial shorts into electrical circuits. For the potentiometer sensor harmful 
resistive faults are detected by the diagnostic monitor, resulting in a DTC and limp-home mode 

60 The PI 121 DTC use in MY 2002 is an earlier form of the P2121 DTC, and thus is included in this analysis. 
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failsafe; however, certain resistive shorts can cause a vehicle drivability issue that presents an 
unusual mode of operation that, in the broadest sense of the tenn, could be considered a type of 
small throttle opening UA. 

Of the 831 Camry UA VOQs reviewed in the study NHTSA has identified two that have and two 
that may have experienced resistive VPA shorting resulting in the drivability issue mentioned 
above. When specific resistive shorts between VPA1 and VPA2 occur, the system generally 
produces a DTC and MIL and, in the initial drive cycle, the vehicle is limited to limp-home 
mode. However, after the initial drive cycle, depressing the accelerator pedal, unless done 
quickly, initially has no effect on engine output (a dead spot) until it is depressed slightly further, 
at which point the throttle may open more than expected and cause the vehicle to jerk forward, 
which could be described as a limited form of UA. However, the UA only occurs in response to 
accelerator pedal application and when the pedal is released the throttle closes and the UA 
ends, 61 the brakes are not affected by this condition and therefore work normally. The amount of 
throttle opening that occurs at the bottom of the dead spot is dependent on a number of factors 
(see the detailed report for a further explanation) but 10 to 15 degree openings have been 
observed by NHTSA. For the four VOQ reports possibly involving this condition, none resulted 
in a crash or injury, all resulted in a DTC and a pedal replacement, and all drivers reported the 
dead spot and jerking condition that occurred when the accelerator was depressed. NHTSA’s 
current assessment is that the frequency of this condition is very low. However NHTSA will 
monitor for additional field failures. The likelihood of a more severe UA incident arising from 
tin whisker shorting is very low. 

The situation for the Hall Effect pedal sensors is different. Unlike the potentiometer sensors, 
these devices use an electronic device (an integrated circuit, or IC) to stabilize the outputs. As a 
result, resistive shorting has less of an effect on the VPA signals. In fact, as has been 
demonstrated by researchers and other members of the public, under very specific conditions 
harmful VPA resistive shorts could exist in the Hall Effect-equipped Camry and go undetected 
by the ECM. Should a second specific fault then subsequently combine with the existing fault 


61 Many VOQ reports involving the potentiometer equipped Camry vehicles state that a UA incident involving high 
power and apparent loss of braking occurred when the accelerator was not being depressed, or initiated when the 
brake pedal was depressed, and accordingly NHTSA does not believe this condition would be a plausible 
explanation for these type incidents. 
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the throttle can open without driver intent. The NASA-NHTSA team has confirmed that, as a 
theoretical matter, dual fault scenarios are a potential risk on the Hall Effect sensors, but neither 
agency has reason to believe that this theoretical risk explains the wide throttle openings 
mentioned in owners’ complaints to NHTSA. It is important to understand that in these 
scenarios the faults must occur within precise resistance ranges and in the proper time sequence; 
otherwise they are detected (or are not a hazard) and result in a failsafe condition. NASA has 
studied the complete family of dual fault scenarios, for both Hall Effect and potentiometer 
sensors types, and discusses them at length in its report. However, because the circumstances 
that produce detected faults are much more likely than those that produce undetected faults, both 
NASA and NHTSA expect that if such faults were occurring in consumers’ use of the vehicle 
that evidence of detected faults, where the range of resistance or the sequence of the faults do not 
meet the narrow criteria to escape detection, would be present in field data such as warranty and 
other complaint data. There is no evidence of such dual faults in the data. 

While the theoretical risk exists for the Hall Effect type sensors in the two-fault scenario, it is 
also important to note that a failure mechanism that can produce either of the required faults has 
not been identified. As explained in NASA’s report, the Hall Effect sensor design has been 
modified to address the failure mechanism (tin whiskers) found in the potentiometer pedal 
sensor. Warranty component replacement and DTC rates, an order of magnitude lower than the 
potentiometer sensors, do not support the presence of a defect trend, and do not provide evidence 
of near misses that are expected if actual in-service failures are occurring. NHTSA’s review of 
188 UA incidents involving Hall Effect equipped Camrys taken from Toyota’s SMART database 
did not show evidence of an ETC-related DTC, nor the presence of either the first or second fault 
required for a dual fault scenario, in any of the 188 cases. Review of 284 ECM warranty return 
analyses did not identify a mechanism for resistive shorting of the APM signals for either the 
Hall Effect or potentiometer sensor. The Hall Effect Camrys are equipped with Event Data 
Recorders (EDR) which capture pre-crash data in certain UA incidents. NHTSA’s analysis of 
EDR data, which is discussed elsewhere in this report, also does not support the presence of a 
vehicle-based causation for the UA incidents studied. Safety Recall 09V-388 retrofitted a brake 
override strategy onto the Hall Effect equipped Camry which adds additional protection against 

62 One such scenario has been demonstrated in laboratory testing by Dr. David Gilbert of Southern Illinois 
University Carbondale. 
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the theoretical dual fault scenarios. Therefore, although theoretically possible, NHTSA believes 
the likelihood of a dual fault failure scenario occurring in consumers’ use of the Hall Effect 
equipped Camry is very low. Moreover, should it ever actually occur, this potential ETC system 
problem would not affect the vehicle’s braking system. 

2.4 Complaints Concerning Fatal Incidents Allegedly Involving Unintended 
Acceleration in Toyota Vehicles Since 2000 

The fact that a consumer complaint alleging a fatal incident exists in NHTSA’s database does not 
mean that NHTSA has determined that the incident arose from a vehicle-based cause. In fact, 
while NHTSA does not have complete information on all of these incidents, NHTSA believes 
that only one of the reported instances (and one unreported fatal incident) is traceable to a 
vehicle-based cause. An understanding of this point is necessary to gain an accurate picture of 
the scope and nature of the UA problem. 

The criteria we used to search the agency’s complaint database to identify fatal incidents that 
allegedly involved unintended acceleration in Toyota vehicles was overly broad so as to capture 
every possible incident. Our analysis included fatalities in Toyota vehicles, pedestrian fatalities 
and fatalities occurring in non-Toyota vehicles. Although we were particularly interested in 
vehicles with ETC, we included all incidents involving a Toyota vehicle, even vehicles with 
mechanical throttles. We included incidents reported to NHTSA from January 1, 2000, through 
December 31, 2010, giving us more than 10 years of complaints. The incidents also had to 
allege unintended acceleration. Incidents where “vehicle speed control” was identified as the 
component or the narrative contained text describing unintended acceleration such as “vehicle 
abnormally accelerated” or “the accelerator stuck” were included. 

As of December 31, 2010, NHTSA received a total of seventy-five (75) complaints concerning 
fatal incidents that allegedly involve unintended acceleration in Toyota vehicles since 2000. The 
reports cover ninety-three (93) fatalities. 

Publicity has affected the reporting of these incidents to NHTSA. The Toyota pedal entrapment 
recall was announced in October 2009, which provides a useful point of reference. Figure 6 
shows fatal incidents by complaint date. Eighty-five percent of the incidents (64 out of 75) have 
been reported to NHTSA since October 2009. In fact, 58 of the incidents (77%) have been 
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reported just since the “sticky pedal” recall in late January 2010, which intensified public 
interest. The most incidents were reported in February and March of 2010, with 22 and 24 
respectively. The latest incident was reported in June 2010. Although a significant time lag 
between an incident and the submission of a complaint does not diminish the complaint’s 
credibility, these numbers strongly suggest that publicity played a major role in the reporting of 
these incidents. Of the 11 incidents that were reported before October 2009, 10 involved 
vehicles with ETC. Of those 10, half (5) were reported during the 3-month publicity spike after 
the original investigation of ETC was opened early in 2004. 
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Figure 6: Fatal Incidents by Complaint Date 

Even though most of these incidents were reported to NHTSA in 2010, very few of them actually 
occurred in 2010. Only six of the reported incidents (involving seven deaths) have occurred in 
2010. Many of the occurrences were in 2009, but some of the recently received reports involve 
incidents dating back several years. Figure 7 shows fatal incidents by year of incident. 
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Figure 7: Fatal Incidents by Incident Date 

In the context of this report, which is focused on the possibility of a safety-related defect in 
Toyota’s ETC system, the incidents of greatest relevance are those involving vehicles equipped 
with ETC. However, 29 percent of these incidents (22 of the 75) and almost one-third of the 
fatalities (29 of 93), including several reported recently, involve vehicles not equipped with ETC. 

The incidents involve a variety of possible unintended acceleration conditions, ranging from 
events that occurred in parking lots with very low initial speeds to events that occurred on 
highways at higher speeds. Only nine of the fatal incidents occurred in parking lots, parking 
garages or private driveways, locations where the large majority of non-fatal UA incidents and 
crashes occurred. These incidents involved 10 fatalities. Thirty-two of the fatal incidents (45 
fatalities) occurred on roadways with a speed limit of 45 mph or higher. In about two-thirds of 
the incidents, the driver did not survive the crash and, as a result, someone else was the source of 
the complaint to NHTSA. 

Of the incidents reported to NHTSA in its complaint database, NHTSA has confirmed one fatal 
incident (the August 2009 crash near San Diego) as having a vehicle-based cause of unintended 
acceleration (pedal entrapment). This incident involved four deaths. (NHTSA has confirmed 
another incident involving one fatality that is not in its complaint database but was believed to be 
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caused by pedal entrapment.) Following Toyota’s pedal entrapment recall, NHTSA received 
two additional allegations of pedal entrapment in fatal crashes involving vehicles within the 
scope of the recall. However, NHTSA’s analysis of those claims determined that neither 
included evidence of pedal entrapment in the police reports or other contemporaneous documents 
and both involved driver citations for impaired driving. 64 

The remaining incidents are unconfirmed allegations of unintended acceleration or, more 
typically, questions about whether fatal crashes may be related to UA. Some of these incidents 
were reported years after the incidents occurred by representatives or family members of the 
deceased, in some cases stating that they were looking for reasons to explain why the incidents 
occurred. In most of these cases, we did not find any substantial evidence to support or deny the 
claims or questions regarding unintended acceleration. Most of the incidents occurred in 2009 or 
earlier and for various reasons we were unable to obtain EDR information on those incidents. 

We did obtain EDR infonnation for five of the cases. Although we were able to obtain most of 
the Police Accident Reports (PARs) for the cases (66 cases), most of the reports do not 
specifically state a possible cause for the accident. The following is the infonnation we obtained 
from the EDR outputs and PARs indicating that, at least in those incidents vehicle-based 
unintended acceleration may not have been the cause: 

o In 12 incidents the police believe alcohol and/or drugs was the major contributing factor 
in the crash, including seven incidents in which the drivers had BAC of 0.08 or greater 
and five incidents where BAC results were not available; 
o EDR data for two of the incidents in which the drivers had BAC of 0.08 or greater 
showed no pre-impact braking; 

o In 11 incidents the information in the PAR suggested that a medical condition may have 
caused the crash, including one in which the EDR showed no pre-impact braking and no 
acceleration; 

o In four incidents information indicated pedal misapplication as the cause of the UA, 
including one in which the EDR showed no pre-impact braking and full acceleration; and 

63 ODI Unintended Acceleration Investigation - 2007 Toyota Camry - California, Case Number DS07035, Dynamic 
Science, July 2007, ( NHTSA SCI Electronic Case Viewer ~). 

64 NHTSA is investigating an additional case that occurred in Utah in November 2010. The case is still active and 
not complete. When the case is completed, it will be available on our website at: http://www- 
nass.nhtsa.dot.gov/BIN/logon.exe/airmislogon 
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o Less than one third (21) of the incidents actually appear to contain a specific allegation of 
UA. In the other incidents there is simply no evidence or even a specific claim that the 
acceleration that occurred was not intended (e.g., crashes where a vehicle runs off the 
road at a steady speed). 

NHTSA is continuing to gather facts on some of these incidents. 65 The important point, 
however, is that any sound analysis of the subject must carefully distinguish the number of 
deaths that have occurred in alleged UA incidents from the much smaller number actually 
established to have been the result of a vehicle-based cause. 

2.5 NHTSA Field Inspections in 2010 

2.5.1 Purpose 

In 2010, NHTSA conducted a series of field inspections of recent crashes involving Toyota 
vehicles involving allegations of UA. 66 Historically, NHTSA’s UA field inspections relied 
solely on the documentation of the vehicle and scene physical conditions, as well as the vehicle 
service/warranty history and testimony from involved parties. As various manufacturers have 
installed event data recorders (EDRs) in their vehicles and made available devices to read those 
recorders, NHTSA has incorporated them into its field inspections and crash investigations. 

EDRs enable NHTSA to collect objective evidence of driver actions immediately prior to the 
crash, which is especially important in UA incidents. NHTSA received its first Toyota EDR 
reader in early March 2010, and immediately began conducting field inspections of alleged UA 
incidents. Throughout March and early April, NHTSA obtained an additional nine EDR readers 
and trained staff from its Office of Defects Investigation (ODI), Special Crash Investigation 
(SCI) office, and the Vehicle Research and Test Center (VRTC) in their use. 


65 A disproportionate number of these incidents involve drivers over age 60, including some in their seventies and 
even eighties. NHTSA is interested in the role played by human factors in UA incidents and is conducting research 
on the greater likelihood of this type of incident among older drivers and possible solutions. 

66 This section summarizes NHTSA’s field inspection activity. Greater detail can be found in the supplemental 
reports cited here. 

67 Event Data Recorders (EDRs) are devices that historically have been used to record information related to a 
vehicle crash. More specifics can be found in Report No. NHTSA-NVS-2011-ETC-SR04. 

68 A synopsis of EDR default data values and basic information on reading the outputs is enclosed in Report No. 
NHTSA-NVS-2011-ETC-SR05. 
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2.5.2 EDR Validation 


A commercially available EDR reader kit 69 manufactured by Bosch exists that covers many 
Chrysler, Ford, and General Motors vehicles. The Bosch EDR outputs are generally accepted 
when accompanied by consistent crash reconstruction work. No such acceptance exists for the 
prototype Toyota readers and, in fact, some parties have pointedly disputed the validity of their 
output. 

NHTSA validated Toyota EDR pre-crash outputs in five major areas: 

1. EDR data outputs were compared to the physical facts of each field inspection that was 
conducted; 

2. Track testing with independent instrumentation validated the pre-crash data elements 
for: brake light switch status, accelerator pedal position, and vehicle speed; 

3. EDR reader veracity and consistency were verified by reading one of the track test EDRs 
with each of the kits in NHTSA’s possession; 

4. Comparison of data retrieved and reviewed with different EDR reader software versions 
showed consistent results, 71 and 

5. An extensive study 72 of a fatal crash in which the EDR readings were publicly called into 
question yielded an explanation of anomalous post-crash data and verified that the pre¬ 
crash data were consistent with incident circumstances. 

The validation work was extensive and is addressed in further detail in the appendices. 
Notwithstanding the “prototype” labeling or characterization, NHTSA has high confidence in the 
veracity of pre-crash data recovered from Toyota’s EDRs and this information is very valuable 
when considered in concert with the physical facts of a given incident. 

2.5.3 Logistics 

Candidate incidents were selected from a variety of sources with the objective of identifying 
vehicles containing pre-crash-capable EDRs involved in alleged UA incidents with accessible 


69 Crash Data Retrieval (CDR) kit sold by Bosch. 

70 Report No. NHTSA-NVS-2011-ETC-SR07. 

71 Report No. NHTSA-NVS-1022-ETC-SR08. 

72 Report No. NHTSA-NVS-2011-ETC-SR09. 
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pre-crash data. Accessibility covered several dimensions that included geography, incident 
timing, vehicle condition, and owner consent. The field inspections originated from a number of 
different sources with consumer complaints to NHTSA accounting for about half of the total. 
Additional sources included police agencies, Toyota data, media outlets, and insurance 
companies. In general, the inspections included a scene assessment, physical inspection of the 
vehicle, interrogation of the vehicle control systems with a Techstream diagnostic tool, recovery 
of the EDR data, and interview of any involved persons. Field inspections were conducted from 
the beginning of March through early August 2010, and are described in greater detail in Report 
No. NHTSA-NVS-2011-ETC-SR10. 

2.5.4 Results 

The 58 field inspections were categorized by finding and incident type. Further explanations of 
each are listed below. Tables listing all the cases by case number and outcome are enclosed in 
NHTSA-NVS-2011-ETC-SR11, and EDR data from the cases are contained in NHTSA-NVS- 
2011-ETC-SR12. 

'7-3 

EDR data were unavailable in six incidents either because no data were found (five cases), or 
because the subject vehicle contained an EDR whose data did not align with the crash reported 
by the driver. 74 

Not every incident reported as UA-related turns out to fit even the broad category. Further 
examination of 12 such incidents revealed a number of different conditions. Only one of these 
incidents involved significant vehicle acceleration 75 and none was found to have any braking of 
significance. 

Five incidents were unexplained roadway/lane departures at speed. None of the information 
collected shows indications of attempts to manage a runaway vehicle (e.g., heated brakes or 
evasive maneuver markings on roadways or terrain). Scene evidence and data collected from the 

73 Physical evidence from those incidents suggests that the vehicles did not experience a severe enough impact to 
enable the EDR. 

74 It did however contain data that were consistent with a less severe (non-UA) impact subsequent to repairs to the 
vehicle. It is believed that the EDR involved with the UA incident was removed and replaced when $9,000 worth of 
repairs were conducted. 

75 This incident, involved a parallel parking maneuver on a city street in which the vehicle wheel was lodged against 
the curb while the driver applied progressively more accelerator input. The driver in this case alleged excessive 
engine power in response to an accelerator input and never alleged a brake application. 
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EDR show little or no acceleration and no brake use of significance. The remaining cases 
include subject vehicles striking other vehicles stopped in the roadway with no acceleration or 
brake use indicated, collisions at intersections, and one parallel parking attempt. 

After subtracting the six incidents in which EDR data were not available and the 12 incidents 
that were not actually UA occurrences, 40 incidents of UA remained. One of those UA incidents 
turned out to be entrapment of an accelerator pedal by an all-weather floor mat. It initiated with 
an on-highway passing maneuver and ended with the vehicle traversing a T-intersection at the 
end of an exit ramp where the vehicle left the roadway. Pre-crash data retrieved from the subject 
vehicle EDR shows the vehicle traveling at high speeds with a relatively high unchanging 
accelerator pedal voltage and consistent brake light switch status of “ON” for the duration of the 
incident. Field inspection of the incident vehicle uncovered evidence that an OE Lexus all- 
weather floor mat had constrained the accelerator pedal after the driver released it at the onset of 
the incident. 

NHTSA believes that the most likely cause of the remaining 39 UA incidents was pedal 
misapplication. Pedal misapplication refers to a situation in which a driver intends to apply the 
brake and inadvertently applies the accelerator instead or, in some cases, applies both the 
accelerator and the brake at the same time (dual application). Pre-crash EDR data provide direct 
and objective evidence of this condition. 

EDR data for 29 (74%) pedal misapplication incidents showed no brake application whatsoever. 
An additional six (15%) showed a “late” brake application. 76 One case apparently involved dual 
pedal application. 

Accelerator pedal position information was also reviewed to better account for the location of the 
driver’s feet. Thirty-five (90%) of the pedal misapplication incidents included either a sustained 
or increasing accelerator pedal application. 

Twenty-eight (72%) of the pedal misapplication incidents examined initiated at speeds of 15 
mph or less. All but one of these took place in a confined space such as a residential driveway or 
commercial parking lot. Those that initiated at higher speeds in traffic include circumstances 

76 Here, a “late” brake application describes the brake light switch status transitioning to “ON” at either 1 sec prior 
to or at the event trigger. This timing/duration is insufficient to meaningfully slow the vehicle in a crash situation. 
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where the driver appeared to intend to use the brakes to decelerate, usually on approach to an 
intersection. 


Parking maneuvers account for over half (24) of the pedal misapplication incidents with parking 
space entry outnumbering parking space exit by a ratio of 2:1. In-traffic deceleration accounted 
for the next largest share (7). 

Driver ages were collected during the inspection activity. Thirty-one (79%) of the pedal 
misapplication incidents involved drivers 55 years or older at the time of incident. Twenty-four 
(62%) of the pedal misapplication incidents involved drivers 65 years or older at the time of 
incident. 

NHTSA’s field inspections of Toyota vehicles in 2010 did not provide evidence of any vehicle- 
based cause of UA of which NHTSA was previously unaware. (One incident appeared to 
involve pedal entrapment by a floor mat.) The inspections indicated that many UA incidents 
continue to occur as the result of the driver’s inadvertent application of the accelerator pedal 
rather than the brake or due to simultaneous application of the accelerator and brake. Vehicle 
characteristics such as pedal placement may have the effect of increasing the likelihood of pedal 
misapplication. 

2.6 NHTSA Acquisition, Characterization, and Testing of Vehicles 

NHTSA obtained 20 Toyota vehicles to pennit extensive testing and examination based on any 
electronic vulnerabilities that NASA’s study might reveal and NHTSA’s need to understand the 
basic characteristics of the vehicles that might have an effect on UA. 77 We chose two types of 
vehicles: (1) eleven “design” vehicles that had not been involved in UA incidents but were 
examples of models of interest, and (2) nine “complaint” vehicles that had allegedly been 
involved in UA incidents. Table 10 shows the make, model, and model year of each of the 
vehicles studied: 


77 NHTSA-NVS-2011-ETC-SR13. 


46 



Table 10: Make, Model, Year of Design vs. Complaint 


Vehicle 

Identifier 

C = 

Complaint 

D = Design 

Vehicle 

Location 

Vehicle 

Model 

Year 

Vehicle 

Model 

Trim 

Level 

Vehicle 

Color 

Engine 

VIN 

UAVOQ 

Mileage 

ID 

VRTC 

2002 

Camry 

SE 

Silver 

V6 

4T1BF30K02UXXXXXX 

No 

125331 

2D 

VRTC 

2002 

Camry 

XLE 

Dark Gray 

L4 

4T1BE32K82UXXXXXX 

No 

69721 

3D 

VRTC 

2001 

Camry 

LE 

White 

L4 

JT2BG22KX10XXXXXX 

No 

94006 

4D 

VRTC 

2007 

Camry 

SE 

Red 

L4 

4T1BE46K574XXXXXX 

No 

89964 

5D 

VRTC 

2006 

Camry 

LE 

Silver 

L4 

4T1BE32K96UXXXXXX 

No 

55319 

6D 

VRTC 

2007 

Camry 

LE 

Green 

L4 

4T1BE46K57UXXXXXX 

No 

161690 

7D 

Goddard 

2005 

Camry 

XLE 

Gray 

L4 

4T1BE32K65UXXXXXX 

No 

69634 

8D 

VRTC 

2001 

Camry 

XLE 

Champagne 

V6 

4T1BF28K31UXXXXXX 

No 

88651 

9D 

VRTC 

2005 

Camry 

LE 

Charcoal 

V6 

4T1BF32K55UXXXXXX 

No 

69649 

10D 

VRTC 

2007 

Camry 

LE 

Green 

V6 

4T1BK46K97UXXXXXX 

No 

53322 

11D 

Goddard 

2005 

Camry 

XLE 

Silver 

V6 

4T1BF30K55UXXXXXX 

No 

65199 

12C 

EMI 

Facility 

2007 

Camry 

XLE 

Burgundy 

V6 

JTN B K46K073XXXXXX 

10319201 

44673 

13C 

EMI 

Facility 

2002 

Camry 

XLE 

Champagne 

V6 

4T1BF30K92UXXXXXX 

10319308 

195266 

14C 

EMI 

Facility 

2004 

Camry 

XLE 

Champagne 

V6 

4T1BF30K34UXXXXXX 

10321093 

77739 

15C 

EMI 

Facility 

2003 

Camry 

XLE 

Deep 

Purple 

L4 

4T1BE32K33UXXXXXX 

10283433 

52773 

16C 

VRTC 

2009 

Camry 

NA 

Blue 

L4 

4T1BE46K39UXXXXXX 

10326631 

23763 

17C 

VRTC 

2004 

Camry 

LE 

Champagne 

L4 

4T1BE32K64UXXXXXX 

10316061 

47776 

18C 

EMI 

Facility 

2004 

Camry 

LE 

Blue 

L4 

4T1BE32K04UXXXXXX 

10327490 

61039 

19C 

EMI 

Facility 

2007 

Camry 

LE 

Gray 

L4 

4T1B E46 K2 7 U XXXXXX 

10326416 

37385 

20C 

VRTC 

2004 

Camry 

LE 

Tan 

L4 

4T1BE32K64UXXXXXX 

10290867 

54822 


The Camry models account for about a third of all the complaints and more than half the crashes 
reported to NHTSA as UA events over the last decade. Accordingly, the Camry seemed like the 
most promising model in searching for a vehicle-based defect. Complaint rates for the first 
model years of the MY 2002-2006 Camry, and the MY 2007-2010 Camry are somewhat higher 
than for other model years of those generations, suggesting that the model changes may relate to 
any potential causes of unintended acceleration. Accordingly, in seeking design vehicles we 
obtained examples of the MY 2002 and 2007 Camry. 
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We also acquired the last build years for model generations adjacent to models that demonstrated 
high rates of unintended acceleration to encompass all mid-model upgrades and changes 
associated with a specific generation. This included the last year of the MY 1996-2001 Toyota 
Camry (2001) and the last year for the MY2002-2006 Toyota Camry (combined 2005 and short 
build year 2006). We included both four-cylinder (L-4) and six-cylinder (V-6) engines from 
each model to encompass differences in wiring, grounding, components, and powertrain 
perfonnance. We also included vehicles that have been reprogrammed with brake override 
software to compare them to the same models that do not have the software revision. The 
MY2007-2009 Toyota Camry (2007) was included in this group. 

In order to select vehicles that had allegedly been involved in UA incidents (complaint vehicles) 
we analyzed vehicle complaint data from vehicle owner questionnaires (VOQs) and other 
sources to identify possible candidate vehicles. We contacted owners of selected vehicles to 
further explore the details of the alleged incidents. This included some site visits and in-person 
interviews. We then selected vehicles to obtain for testing and evaluation. Selection criteria 
included vehicles for which floor mat entrapments and “sticky pedals” were not claimed as 
causes by the complainant. The vehicles had to be drivable. If essential electronic components 
had been replaced, those vehicles would have been disqualified from testing. When we acquired 
vehicles we also received their repair history documentation. 

In addition to the Camry design and complaint vehicles selected for characterization and testing 
due to their prominence in the complaint data, NHTSA acquired three other Toyota vehicles that 
had been involved in noteworthy UA incidents including a 2008 Toyota RAV4, a 2007 Lexus 
ES350, and a 2010 Toyota Corolla. 78 While they were not specifically the subject of the NASA 
ETC review or of this report, VRTC subjected these vehicles to examination and testing similar 
to what was done with the 20 Camrys. 79 To date, no testing in any of these three vehicles has 
produced incidents of UA caused by factors other than floor mat entrapment or “sticky pedals.” 

78 Complainant test vehicles other than Camrys include: 1) 2008 Toyota RAV4, ODI Complaint No. 10328464, 2) 
2007 Lexus ES350, ODI Complaint No. 10182245, and 3) 2010 Toyota Corolla, ODI Complaint No. 10327521. 

79 The 2007 Lexus ES 350 has undergone the most extensive testing of these three vehicles, including all of the 
characterization testing discussed in this section, additional testing of the accelerator control circuits to detect 
anomalies, a broad range of EMC testing using the same parameters applied to the complaint vehicles, and specific 
testing of aspects of the vehicle’s operation mentioned in the complaint, NHTSA has not found any problems with 
the vehicle other than its susceptibility to pedal entrapment by the type of all-weather floor mat that was in the 
vehicle at the time of the incident. 
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NHTSA will continue to examine these vehicles with whatever additional testing might be 
appropriate (e.g., continued mileage accumulation to see if the complained-of behavior might re¬ 
appear). 

2.7 Vehicle Characterization Test Methodology 

Test vehicles had various features and capabilities measured to discover whether factors other 
than electronics may contribute to instances of unintended acceleration. 

All acquired vehicles were subjected to all characterization tests. Vehicle characterization 
efforts were divided into eight modules. Some modules documented vehicle history and 
confirmed fitness for test use. Other modules tested braking and acceleration perfonnance under 
changing conditions. 

2.7.1 Module 1 - Preliminary Inspections and Visual Verification 

This module began the processing of each vehicle and verified the basic information and 
condition of the vehicle. Vehicle features and options were documented along with a multitude 
of other visually verifiable items. Examples include but are not limited to: make, model, year, 
color, trim level, engine, vehicle identification, mileage, tire type/tread depth, etc. 

Documentation from this module also identified whether the vehicle was acquired because it was 
a complaint vehicle (denoted with a “C”) or a vehicle acquired for a design change comparison 
(denoted with a “D”). If it was identified as a complaint vehicle, this triggered the collection of 
other documents associated with the incident. Malfunctioning or abnormal conditions were then 
recorded for corrective action in Module 2, 3, or 4. 


2.7.2 Module 2 - Comprehensive Inspections and Electronic Interrogation 

In this module, significant interrogation of vehicle systems took place and results were recorded. 
Event data recorders were imaged, electronic control unit diagnostic trouble codes (DTCs) were 
downloaded, and technical service bulletins and recall fulfillment were verified. Accelerator 
pedal position sensor voltages and rates were measured. Transmission specifications were 
documented. Repair history was researched. Functionality of vehicle systems was confirmed by 
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a certified mechanic. Any deferred maintenance was either corrected during this module or the 
vehicles were scheduled for repair in Module 4 - Repairs and Restoration. 

2.7.3 Module 3 - Drivability Fitness 

Each vehicle was subjected to a test drive by a certified mechanic to determine if the vehicle was 
perfonning appropriately. This included all relevant systems on the vehicle, with special 
emphasis on systems that were given authority over the accelerator control system, such as cruise 
control. If the vehicle was in the population receiving brake override reprogramming, then the 
presence of brake override was confirmed. Any deficiencies found would cause the vehicle to be 
scheduled for repair in Module 4 - Repairs and Restoration, with the exception of complaint 
vehicles, where deficiencies would have been studied further to detennine if they were related to 
the alleged defect. Deficiencies would have been items such as worn wheel bearings, poor 
alignment, braking problems, electrical charging problems, etc. though no test vehicles exhibited 
these conditions. 

2.7.4 Module 4 - Repairs and Restoration 

This module addressed all known deficiencies in a given vehicle that would otherwise have 
invalidated or compromised the performance of the vehicle during testing, with the exception of 
complaint vehicles. Successful completion of the module confirmed that the vehicle was safe for 
testing. 

2.7.5 Module 5 - Acceleration and Braking Assessment 

This module contained the dynamic portion of the testing that measured the effect of full throttle 
acceleration on the performance of brake systems that a driver could expect during unwanted 
acceleration events. Here each vehicle underwent acceleration and braking performance tests to 
quantify the effectiveness of brake systems with and without the assistance of vacuum. Tests 
included baseline acceleration, followed by a series of acceleration tests while braking using 
standard FMVSS 135 brake pedal forces of the following values: 0 lbs., 15 lbs. (67N), 50 lbs. 
(222N), 112 lbs. (500N), and 225 lbs. (1,000N). Subsequent braking tests were conducted using 
similar forces to measure stopping distances of each vehicle traveling at 65 mph. These tests 
were conducted with 1) no acceleration, 2) full acceleration with vacuum assisted braking, and 3) 
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full acceleration without vacuum assisted braking. Brake pedal pressures were controlled with a 
pressure regulated pneumatic cylinder actuated at the appropriate time. At the beginning of each 
vehicle’s brake test module and again at the end of the module, a 100-0 mile per hour panic stop 
was conducted to measure the pennanent effect of the repeated brake tests on stopping 
capability. Brake temperatures were monitored to ensure that brakes were not above 300 degrees 
Fahrenheit prior to any brake test. The braking tests were conducted with new friction materials 
and rotors, and had been processed through appropriate burnishing procedures in order to 
appropriately wear the brakes to a slightly worn condition similar to what would be expected 
from several miles of normal stop and go driving. Five of the vehicles submitted for testing, all 
2007-2009 Camrys, were reprogrammed by Toyota with brake override to measure the software 
effectiveness in slowing the vehicle while applying engine throttle. These brake tests 
demonstrated a quantifiable benefit of the brake override system in tenns of reduced stopping 
distance. In some tests brake override was intentionally disabled in order to measure and 
compare braking performance. 

2.7.6 Module 6 - Gearshift Lever 

During an unwanted acceleration event, the ability to quickly and simply disengage the engine 
from the transmission and drive wheels becomes an effective means of averting what can 
otherwise quickly become an emergency situation. The gearshift pattern and required 
movements to achieve drive, neutral, reverse, and park were measured, photographed, and 
documented. Extra efforts, such as squeezing a button on the shifter to place the vehicle into any 
gear were recorded. Transmission features such as the number, type, and condition of mounts 
were noted. The number of forward gears was identified. 

2.7.7 Module 7 - Ignition Switch Control Functionality 

When a driver encounters an unwanted acceleration situation, the ability to turn power off to the 
engine becomes a valuable countermeasure. The functions of the keyed ignition have remained 
relatively unchanged over the years, but a pushbutton ignition requires a driver to leam new 
procedures, not all of which may be intuitive. With regard to an unwanted acceleration event, 
the most relevant of these new procedures is the emergency shutdown operation. The presence 
of a key or pushbutton ignition switch control system was documented to help understand 
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difficulties motorists may encounter when attempting to turn off the engine in an emergency 
condition. 

2.7.8 Module 8 - Pedal Position 

Module 8 measured the orientation, location, and operation of the accelerator and brake pedals in 
relation to the driver. Pedal interaction with the floor pan was also characterized. 

Brake and accelerator pedal position, static step-over distance between the brake and accelerator 
pedal, dynamic step-over (i.e., critical vertical offset,) 80 and horizontal relative location was 
measured. Documentation included pedal construction and material. 

Contours and dimensional measurements of the floor pan and associated protective materials and 
pedal interaction with the floor pan was described and documented. The propensity for the 
interaction between the floor pan and accelerator pedal to lead to pedal entrapment was evaluated 
using a series of attributes that are believed to mitigate or aggravate instances of pedal 
entrapment including: 

1. Spring return force; 

2. Pedal hinging methods; 

3. Geometric interaction with the floor pan; and 

4. Positive backstop location. 

Original carpeted floor mats and all-weather floor mats were placed in various orientations in the 
driver’s foot well area to detennine whether an interference condition with the accelerator pedal 
actuation could occur. 


so Dynamic step-over, also referred to as critical vertical offset is the perpendicular distance between the surface of 
the brake pedal and the surface of the accelerator pedal, required to cause a stationary vehicle to begin to move 
while depressing both the brake pedal and accelerator pedal simultaneously with a specified brake pedal force. 
Static step-over measures the perpendicular distance between the surface of the pedals when the pedals are at rest 
and not being applied. 
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2.8 Vehicle Characterization Test Results 


2.8.1 Foot Pedals Interface and Electronic Accelerator Pedals 

The electronic accelerator pedal and electronic throttle control were introduced in Toyota 
Camrys in MY 2002. This changed the way the driver interfaced with the accelerator control 
system. While depressing the electronic accelerator pedal still caused the engine to produce 
power, it did so at a different rate and with a different level of effort from the operator. 

Electronic accelerator pedals found in 2002 and newer Camrys provided faster throttle response 
with less pedal displacement than cable driven throttles. Increased responsiveness is a typical 
characteristic of ETC as compared to mechanical linkage accelerator control systems. With the 
introduction of ETC, the mechanical accelerator system of a cable and remotely located spring at 
the far end of the cable was replaced with electronic sensors with springs located next to the 
driver’s foot. The cable mechanism had compliance (slack) that was not emulated by the 
electronic pedal, which caused the ETC pedal to be more responsive. The electronic accelerator 
pedal-force-versus-displacement effort in the 2002 Camry was measured and found to be 
somewhat similar to the brake pedal-force-versus-displacement effort, which could make it more 
difficult for an operator to discern the difference between the two pedals merely by the feel of 
the pedal. This similarity in feel between the two pedals could theoretically increase the 
likelihood of pedal misapplication, although NHTSA has no evidence that the change produced 
that result. 

In models tested, which provided a very limited sample for making this type of comparative 
measurement, the lateral separation distance (open space) between the brake and accelerator 
pedals decreased beginning in 2002, mostly due to the accelerator pedal having been moved 
closer to the steering wheel centerline (to the left), which could make it more feasible, as a 
matter of geometry, for a driver to apply both pedals with one foot than had been the case in 
previous Camry models. More important, however, is the actual lateral separation between the 
accelerator and brake pedals. In the specific vehicles tested, some variation in lateral separation 
distance was found, but none measured less than 63.5 mm. Therefore, regardless of the fact that 
the accelerator pedal was moved closer to the steering wheel center line, these vehicles are well 
within the range of peer vehicles with regard to lateral separation, which is an important 
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consideration in assessing whether the pedal placement can contribute to the occurrence of pedal 
misapplication. 

Static step-over height (the vertical difference between accelerator and brake pedals when neither 
is applied) is another factor to consider with regard to pedal misapplication. The vehicles tested 
were within Toyota’s earlier specifications for step-over, except for one that measured just 22 
mm, although this pedal was slightly twisted during brake testing. 

In general, the changes made to the pedal operation at the time that ETC was introduced in the 
MY 2002 Camry were typical of the changes inherent in the shift from mechanical pedals to 
electronic pedals; the electronic pedals exhibit somewhat quicker response with less 
displacement. The changes made to pedal placement in this new model, which included moving 
the accelerator pedal a bit closer to the steering wheel center line, did not result in abnonnal 
lateral spacing between the accelerator and brake. NHTSA does not have a basis for concluding 
that any of these pedal characteristics made pedal misapplication more likely than in other 
vehicles. However, the work done on these issues combined with the fact that pedal 
misapplication continues to be a leading cause of UA gives NHTSA reason to leam more about 
the auto industry’s pedal placement and operation criteria as they may relate to pedal 
misapplication. NHTSA plans to explore these issues through future research. 

2.8.2 Acceleration and Braking 

How vehicles perform when their brakes are applied is relevant to whether they could overcome 
or prevent a UA incident. NHTSA wanted to detennine how the test vehicle performed in 
certain situations where brakes were in normal operating condition and also when braking 
vacuum was depleted (which could occur in prolonged UA incidents where drivers pump the 
brakes). 

Vacuum assisted brakes, standard on most autos manufactured today, rely on engine vacuum to 
provide braking assistance. Braking vacuum in the tested Camrys multiplied the brake gain by 
five to six times the force applied to the pedal. If the brakes were pumped more than once while 
the accelerator was depressed, vacuum was partially, if not fully depleted and would not 
regenerate until the throttle plate moved to a more closed position. Without vacuum, a 
significant increase in operator effort was required to stop the vehicle. 
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When braking was applied in one continuous motion where vacuum assist was operating 

normally and the engine was at full throttle, all tested Camrys either came to a stop from 65 

81 

MPH or almost to a stop with 112 lbs. or less of brake pedal force. 

The amount of brake pedal force required to hold the test vehicles stationary with a wide open 
throttle ranged from 15.0 lbs. to 43.6 lbs. with vacuum assist, which is well within the braking 
capabilities generated by the vast majority, if not all, drivers. Without vacuum assist, force 
required to remain stationary ranged from 86.7 lbs. to 268.2 lbs.(which is beyond the reasonable 
amount of force a driver could apply). NHTSA’s complaint database does not contain any 
instances of stationary Camrys lacking vacuum assist, so these latter measurements are based on 
a purely hypothetical situation. 

In short, the braking systems on these vehicle were found more than adequate to be effective in 
nearly every type of potential UA incident, even those involving a wide open throttle, unless the 
vacuum has been depleted by pumping the brake. Even in that case, the brake can overcome 
engine torque, although the brake pedal force necessary to do so increases substantially with the 
speed at which the incident occurs. These conclusions are important for two reasons: (1) they do 
not support assertions made in many UA complaints that a vehicle’s brakes were not effective in 
overcoming a UA event, particularly at lower speeds; and (2) they help explain some of the 
much more infrequent higher speed incidents involving the more powerful vehicles where, 
perhaps due to a loss of vacuum assist, braking was reported to be difficult. 

2.8.3 Gearshift and Transmission Shifting 

Shifting the transmission was more complicated with the newer models. In 2002 and model 
years prior, moving the shifter from park to drive required only one longitudinal movement. By 
2007, shifting to drive also required at least one lateral movement for four cylinder vehicles and 
two lateral movements for V-6 Camrys. In all test vehicles, the transmission shifter was 
mechanically li nk ed to the transmission. Placing the vehicle into park or reverse at highway 
speeds and under acceleration caused the vehicles to go to neutral and did not cause any of the 
vehicles to engage those shift positions; though this action caused both 2001 Camrys to stall. 


81 112.4 lbs. (500N) is used as a standard maximum braking force used in brake testing under CFR49 571.135. This 
value was adopted in part, for international harmonization of standards as noted in FR Volume 60/No. 22. 
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2.8.4 Floor Pan Geometry 


Foam padding was placed under the carpet toward the front of the floor pan in the driver’s foot 
well area beginning in MY 2007. This foam was not present behind the accelerator pedal, 
creating a cavity where the accelerator pedal could pass the plane of the floor pan foam. Objects 
such as floor mats that could be pulled into this cavity would have a higher likelihood of creating 
pedal entrapment than those without the contoured padding. This condition was alleviated in the 
2009 pedal entrapment recall because the shortened pedals are less capable of passing the plane 
of the floor pan foam. 

3.0 STUDY OF TOYOTA’S ETC SYSTEM AND UA POTENTIAL: 
NASA’S ACTIVITIES 

3.1 Scope of NASA Study 

The scope of the NASA Toyota unintended acceleration study was to determine if there are 
design and implementation vulnerabilities in the Toyota ETC system that could possibly cause 
UA that can realistically be expected to occur in consumers’ use of these vehicles, and, if so, 
whether these failure modes can be specifically identified and demonstrated through testing of 
vehicles or vehicle components. 

When completed, the analysis and testing were intended to identify potential vulnerabilities 
(whether electronic, mechanical, or human), if any, and answer the following questions: 

1. What specific conditions, both internal and external, are necessary for these failure 
conditions to occur? 

2. Are those conditions evident in the reported cases found in consumer complaints, 
warranty data, field investigations, and physical/forensic examination of parts collected 
from the field? If not, is there other evidence that the conditions can realistically be 
expected to occur in the vehicle’s operating environment? 

3. What physical or electronic evidence does the failure produce? If none, why? 

4. What are the expected ranges in severity (throttle opening) and duration that could be 
caused by the failure? 

5. Could the failure have any effect on other interfaces, such as braking system? 
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3.2 Methodology 


The methodology used by NASA in its study is described in the NASA report. In summary, 
NASA employed a functional safety approach to explore the potential for UA based on an 
understanding of the ETC design and its implementation and how the integrated system and its 
component elements may be vulnerable. Where potential vulnerabilities were identified, 
laboratory and vehicle tests were designed to determine whether the vulnerabilities were actually 
present. Then, NASA examined complaint and warranty data to detennine whether any of the 
potential vulnerabilities had exhibited themselves in the real world. 

3.3 Peer Review 

To provide an additional level of independent examination, NHTSA tasked the Volpe Center to 
conduct a peer review of the test plans developed by NASA and VRTC to study the problem of 
Toyota UA. The Volpe Center put together a panel of experts to help conduct this review. A 
summary of the peer review process is contained in Report No. NHTSA-NVS-2011-ETC-SR14. 

4.0 NASA FINDINGS, OBSERVATIONS, AND RECOMMENDATIONS 

NASA undertook its study of Toyota’s ETC system to support NHTSA’s efforts to understand 
and analyze the safety of that system. Below we set forth the findings, observations, and 
recommendations as taken directly from the NASA report. The NASA organization that 
conducted the study is the NASA Engineering and Safety Center (NESC). 

4.1 Findings 

The majority of the engineering analysis associated with the study of UA was limited to MY 
2005 Camry, L4 ETCS-i. Some analysis and testing was completed on MY 2005 L4 and V6, and 
a MY 2007 ETCS-i simulator. EMC testing was only performed on VOQ vehicles from MY 
2002, 2003, 2004, and MY 2007. The following findings are based on this engineering analysis 
and testing. 

F-l. No TMC vehicle was identified that could naturally and repeatedly reproduce large 
throttle opening UA effects for evaluation by the NESC team. 
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F-2. Safety features are designed into the TMC ETCS-i to guard against large throttle opening 
UA from single and some double ETCS-i failures. Multiple independent safety features 
include detecting failures and initiating safe modes, such as limp home modes and fuel 
cut strategies. 

F-3. The NESC study and testing did not identify any electrical failures in the ETCS-i that 
impacted the braking system as designed. 

a. At large throttle openings (35 degrees (absolute) or greater), if the driver pumps 
the brake, then the power brake assist is either partially or fully reduced due to 
loss of vacuum in the reservoir. 

b. NHTSA demonstrated that a MY 2005 Camry with a 6 cylinder engine travelling 
at speeds up to 30 mph can decelerate at better than 0.25g with 112 lbf on the 
brake while the throttle is open up to 35 degrees (absolute), with a depleted 
vacuum assisted power brake system. 

F-4. For pedal assembly failures to create large unintended throttle openings, failures need to 
mimic valid accelerator pedal signals. 

a. Two failures in the precise resistance range, to create the exact circuit 
configuration in the correct time phase are necessary for this functional failure to 
occur. Failure to meet these restrictive conditions will generate a DTC. 

b. Some first failures in dual failure scenarios of Hall Effect accelerator pedal 
systems might not be detectable by the ECM or via diagnostic data to the OBD 
interface. 

c. A review of the warranty data does not indicate an elevated occurrence of pedal or 
ECM related DTCs relative to UA VOQs. 

F-5. Destructive physical analysis of a failed pedal assembly from a VOQ vehicle with a DTC 
found a tin whisker ~ had formed a 248 ohm resistive short between VPA1 and VPA2. A 
second tin whisker of similar length was growing from a 5 volt source terminal adjacent 
to a pedal signal output tenninal, but had not made contact with any other tenninals. 
Inspection of “non-failed” potentiometer pedals revealed tin whiskers present in similar 
locations as the failed pedal. 

82 Tin whiskers are electrically conductive, crystalline structures of tin that sometimes grow from surfaces where tin (especially electroplated tin) 

is used as a final finish, http://nepp.nasa.gov/whisker/ 
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a. Destructive physical analysis shows the Denso Hall Effect accelerator pedal 
sensor is protected against the tin whisker resistive shorts. The CTS pedal 
provides physical separation between the VPA1 and VPA2 thereby removing one 
component of the dual fault scenarios. 

F-6. Vehicle testing of a MY 2005 Toyota Camry demonstrated that a 248 ohm short between 
VPA1 and VPA2 results in different vehicle responses depending on the sequence of 
operations following the fault. In all cases, releasing the accelerator pedal closes the 
throttle, and brakes are fully operational. 

a. If the resistive short occurs while the vehicle is off, starting the vehicle with the 
accelerator pedal partially depressed will not trigger a diagnostic trouble code. 
When the accelerator is pushed slowly, the vehicle has a jumpy response, and is 
capable of full throttle without throttle brake override. When the accelerator 
pedal is pushed quickly, the fail-safe limp home mode is active including brake 
override. 

b. If the resistive short occurs while driving, a DTC is declared along with a MIL, 
and fail-safe limp home mode is active including throttle brake override 
capability. 

c. If the key is cycled after the resistive short, the DTC and MIL remain. When the 
accelerator is pushed slowly, the vehicle has a jumpy response, and is capable of 
full throttle without throttle brake override. When the accelerator pedal is pushed 
quickly, the fail-safe limp home mode is active including brake override. 

d. If the battery is disconnected with the resistive short, or the DTCs are otherwise 
cleared, DTCs will not return. When the accelerator is pushed slowly, the vehicle 
has a jumpy response and is capable of full throttle without throttle brake 
override. When the accelerator pedal is pushed quickly, the fail-safe limp home 
mode is active including throttle brake override. 

F-7. Functional failures of the cruise control can result in 0.06 g’s, or 2.12 kph/s, acceleration 
and may not generate a DTC; however, there are multiple methods for cancelling or 
turning off cruise control. 
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F-8. Functional failures of idle speed control, transmission control, VSC, and throttle control 
may result in throttle openings of less than 5 degrees above idle and may not generate a 
DTC. Per a NESC team request: 

a. NHTSA demonstrated that a MY 2005 Camry with a 6 cylinder engine can be 
held in a stopped condition with a brake pedal force of approximately 8.5 lbf 
with throttle openings up to 5 degrees above idle. 

F-9. Comprehensive electromagnetic compatibility testing well beyond recommended 

certification levels was performed on six different TMC VOQ vehicles to detennine 
EMC levels that could have an effect. No throttle control vulnerabilities from EMC 
radiated testing were identified that would result in throttle increase. 

F-10. Extensive software testing and analysis was performed on TMC 2005 Camry L4 source 
code using static analysis, logic model testing, recursion testing, and worse case 
execution timing. With the tools utilized during the course of this study, software defects 
that unilaterally cause a UA were not found. 

4.2 Observations 

0-1. Resolution of a UA depends on driver awareness of mitigations, driver response, UA 
situations (e.g., open highway, crowded parking lot), and other factors (e.g., 
environmental). Some VOQs indicate that some drivers may not know or understand the 
vehicle response for the hazard controls at their disposal and how to use them. For 
example: 

a. Shifting to neutral with the resulting high engine speed will not hann the vehicle. 

b. Pumping the vacuum assist brakes can decrease their effectiveness. 

c. Turning the vehicle off while driving may require a different sequence than when the 
vehicle is stopped and will not lock the steering wheel. 

d. Shifting patterns vary between vehicles and within a vehicle may require different 
motions to get to neutral when in modes other than drive and reverse. 

0-2. During testing, the limp home mode safety feature closed the throttle when the brake was 
pressed. When the brake can override the throttle command it provides a broad defense 
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against unintended engine power whether caused by electronic, software, or mechanical 
failures. 

0-3. Failures of safety critical systems in the ETC do not provide the same driver infonnation 

as failures that occur in the safety critical brake systems. A unique red ‘warning light’ is 
illuminated for the brake system, while only a generic, multi-purpose check engine light 
occurs for off-nominal ETC conditions. 

0-4. The Government-mandated (Environmental Protection Agency) DTCs are for emission 
control and are not mandated to cover safety critical failures. 

0-5. Vehicles that are operated with an active accelerator pedal sensor fault, either with the 
MIL on or off, may be susceptible to the effects of second faults, leading to possible 
unintended accelerations. 

a. NHTSA evaluated 188 Swift Market Analysis Response Team (SMART) data 
sets from TMC complaint vehicles and found no proof that the second fault is 
occurring and resulting in UA in those vehicles. 

0-6. While not resulting in a design vulnerability, the MY 2005 Camry source code required 
unique code inspection tools, and manual inspections due to: 

a. The TMC software development process uses a proprietary developed coding 
standard. 

b. Industry standard static analysis tools provide automated code inspections based 
upon industry standard code implementations. 

0-7. There are no methods for capturing pre-event software state and performance following a 
UA event either on the vehicle or as a diagnostic tool. 

0-8. The available incident reporting databases are valuable for identifying potential vehicle 
symptoms related to UA events. However, voluntary reporting systems may not allow for 
accurate quantitative estimates of incident rates or statistical trends. 

0-9. A review of HF literature related to UAs indicates that pedal misapplication remains an 
identified cause of some UAs. However, it is not possible to accurately estimate from 
available survey and laboratory data how frequently this error is an underlying cause. 

0-10. Given that driver errors such as pedal misapplications are best characterized as low- 

probability random process events, it is difficult to study them in a controlled laboratory 
environment (e.g., human-in-the-loop driving simulation studies). Manipulations that 
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might be performed to increase the observed frequency might also compromise the ability 
to generalize the findings under consumers’ use of the vehicle. 

0-11. Design features, such as sport shifter and push button stop, might compromise the 

driver’s ability to recover from a UA event. Such features may be indicative of broader 
driver-vehicle integration issues and therefore may merit further consideration. 

4.3 NESC Recommendation 

R-l. It is recommended that NHTSA consider whether additional study, government 

regulation, or policy is warranted based on the findings and observations within this 
report. 

a. Controls for managing safety critical functions, as currently applied to the 
railroad, aerospace, military and medical sectors, warrant consideration. 

5.0 NHTSA’S PLANNED ACTIONS BASED ON THE STUDY OF 
TOYOTA’S ETC SYSTEM AND UA POTENTIAL 

5.1 NASA’s Findings 

Based on NASA’s evaluation of Toyota’s ETC system and NHTSA’s own review of data and 
examination of vehicles as explained in this report, NHTSA concludes that the Toyota ETC 
system does not have design or implementation flaws that could reasonably be expected to cause 
UA events involving large throttle openings as described in consumer complaints to NHTSA. 
Failures that mimic valid accelerator pedal signals can be induced to produce large throttle 
openings. However, no single failure can produce such a condition. Two failures in the precise 
resistance range necessary to create the exact circuit configuration in the correct time phase are 
necessary for this functional failure to occur. As NHTSA understands the situation, the 
likelihood of two such specific failures occurring in a consumer’s use of a vehicle in the precise 
resistance range and in the required sequence necessary to produce the UA condition is remote. 
Moreover, the occurrence of such failures outside of these very narrow conditions will always set 
a diagnostic trouble code (DTC). Thus, if these failures have occurred, they would be much 
more likely to occur in the far larger zone that would produce a DTC than in the exceedingly 
narrow set of conditions that would not produce a DTC. The absence of any trend of such DTCs 
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being set and recorded in warranty data strongly suggests that the much more unlikely events 
that do not leave a DTC are not occurring in the real world. 

NASA did detennine through microscopic analysis of a failed pedal obtained from a field 
incident that certain resistive faults can result from the presence of tin whiskers within the 
accelerator pedal position sensor. In vehicles with potentiometer sensors (MY 2002-2006), 
NASA found that this kind of resistive short generally produces a DTC, warning light, and fail¬ 
safe operation, but results in different vehicle responses depending on the subsequent operation 
of the vehicle following the occurrence of the fault. In the field incident in which the pedal 
examined by NASA was involved and in the only other three incidents that appear to be of that 
nature found in the VOQs, the resistive short triggered a DTC and fail-safe operation. In each 
case, the owner brought the vehicle for servicing because of the lack of acceleration and 
somewhat jumpy throttle response and the vehicle was repaired without damage or injury. Also, 
the unwanted acceleration in this situation is relatively small (up to 15 degrees of throttle 
opening), ceases immediately when the accelerator pedal is released, and is readily controlled by 
braking, which is unaffected. Moreover, NHTSA’s analysis of its own complaint data and 
Toyota’s warranty data indicates that conditions that produce a DTC related to pedal failure are 
very rare in these vehicles, indicating an extremely small likelihood of such conditions, and an 
even more remote chance of conditions producing such a short without producing a DTC. 
Accordingly, there is currently no evidence of a real-world safety risk produced by this 
phenomenon. However, the nature of the fail-safe operation after the first drive cycle suggests 
Toyota has adopted an imperfect fail-safe strategy for that particular kind of fault. 

In the case of vehicles with Hall Effect sensors (MY 2007 and later), NASA indicated that the 
presence and growth of tin whiskers within the sensor circuitry is significantly less likely than in 
earlier models due to the Hall Effect sensors’ circuit board tenninal architecture and 
construction. NHTSA’s own analysis of complaint and warranty data supports that view. 
Moreover, NHTSA’s examination of data obtained from the engine control modules of nearly 
200 vehicles of this type that were involved in alleged UA incidents found no evidence that a 
latent resistive short producing abnormal pedal sensor voltages was present in those vehicles. 
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NHTSA is aware that, as NASA has found, certain “functional failures” ~ of idle speed control, 
transmission control, vehicle stability control, or the throttle assembly can result in a throttle 
opening of less than five degrees and may not leave a DTC. NHTSA has conducted the testing 
referred to in NASA’s finding on this point indicating that vehicles experiencing these 
phenomena in the worst case (i.e., an occurrence from a standing start, where the additional 
acceleration would be most perceptible) can be held in a stopped condition with a brake pedal 
force of about 10 lbs. This is a very small amount of pedal force. NHTSA testing indicates that 
drivers generally apply an average of 8.0 lbs. of force to hold a vehicle in a stopped position on 
level ground. Accordingly, although these phenomena could explain some complaints involving 
very small amounts of acceleration from a stopped position, NHTSA does not believe that these 
conditions present safety risks to the vehicle occupants. NHTSA understands that the cruise 
control system has two possible vulnerabilities that could result in a throttle increase but 
concludes, based on NASA’s findings on this subject, that these vulnerabilities produce 
negligible acceleration and no safety hazard. 

NHTSA notes that NASA specifically states that it did not identify any ETC failures that impact 
the braking system. NHTSA concludes that any claimed lack of braking effectiveness in a UA 
incident could not be attributable to a failure in the ETC system. In other words, if the braking 
system of a Toyota vehicle fails, an electronic fault in the ETC system is not the cause. 

NHTSA also notes that NASA’s extensive electromagnetic compatibility testing of the Toyota 
vehicles indicated no throttle control vulnerabilities despite the fact that the testing went well 
beyond recommended certification levels. NHTSA understands that NASA’s unprecedented 
software testing and analysis of the ETC source code demonstrated no evidence of software 
coding flaws in the ETC system that could produce UA. Moreover, NHTSA is well aware, as 
NASA has found, that the safety features designed into the Toyota ETC system serve to prevent 
large throttle opening UA caused by ETC failures. 


83 NHTSA does not consider these phenomena failures in the way it uses that term because they are in many cases 
design features that produce very limited uncommanded acceleration. 

84 EMI testing produced one failure in a Denso accelerator pedal that was not related to UA. This is described in 


NHTSA-NVS-2011-ETC-SR15. 
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5.2 NASA Observations 


NHTSA appreciates NASA’s observations. Those concerning software issues will inform 
NHTSA’s planned actions with regard to safety-critical control systems. Those concerning the 
nature of warnings given to the driver in the event of failures of safety-critical systems will be 
considered in determining any necessary changes to the agency’s standard concerning safety- 
related visual displays in the vehicle. The observation on DTCs not clearly distinguishing 
safety-critical failures will be considered as part of NHTSA’s continued review of electronic 
control systems. NHTSA will consider NASA’s observations on brake override, push-button 
stop and the possible driver confusion caused by some sport shift modes as it decides on 
potential rulemaking options related to UA events. NHTSA will consider NASA’s observations 
on pedal misapplication as it continues its research efforts in that area. 

5.3 NASA’s Recommendation 

NASA made a very broad recommendation that NHTSA review the findings and observations in 
its report and consider whether additional study, regulation or policy is warranted. NHTSA has 
carefully reviewed NASA’s findings and observations and explains below how its planned 
actions will address them. NASA’s recommendation included one more specific suggestion: 
controls for managing safety-critical functions - as currently applied to the railroad, aerospace, 
military and medical sectors - warrant consideration. NHTSA fully agrees with that suggestion 
and will consider such controls in its further work on vehicle electronics. 

5.4 NHTSA’s Planned Actions 

Having fully considered NASA’s complete report and based on NHTSA’s own activities and 
observations on these subjects, NHTSA plans to take the following actions: 

• NHTSA will consider initiating rulemakings on brake override systems, keyless ignition 
systems, and event data recorders. Brake override systems may prevent or mitigate some 
UA incidents by ensuring that, when the brake is applied, the braking system has priority 
over the throttle. NASA observes in its report (Observation 0-2) that such a system 
“provides a broad overarching defense against unintended engine power” from a wide 
range of causes. Keyless ignition systems can exacerbate UA incidents (particularly 
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prolonged incidents involving a stuck accelerator pedal) if the driver cannot determine 
how to shut off the engine quickly. Event data recorders can provide crash investigators 
objective infonnation relevant to UA incidents that result in crashes sufficient to trigger 
the devices. These devices are currently voluntarily installed on 85% (est.) new vehicles 
in the U.S. 

• NHTSA will begin preliminary research on the reliability and security of electronic 
control systems by examining existing industry and international standards for best 
practices and relevance to automotive applications. In this research, NHTSA will give 
full consideration to NASA’s recommendation that NHTSA consider controls for 
managing safety critical functions as currently applied to the railroad, aerospace, military, 
and medical sectors. NHTSA will also give full consideration to NASA’s findings and 
observations as they relate to the use of diagnostic trouble codes in conveying safety- 
critical infonnation to drivers, safety-critical software design and validation 
methodologies, and robust fail-safe strategies that protect against two-fault scenarios 
(including those involving resistive short circuits and latent faults). The agency 
anticipates that the NAS panel will offer recommendations on these subjects and wishes 
to enhance its own understanding of the subject area. 

• NHTSA will begin research on the placement of accelerator and brake pedals and driver 
usage of pedals. NHTSA is interested in learning whether the frequency of pedal 
misapplication can be significantly reduced through pedal placement specifications and 
operational characteristics. 

• Along with NASA, NHTSA will brief the National Academy of Sciences panel that is 
conducting a broader study of UA and electronic control systems to ensure that the panel 
has the benefit of the work done by the two agencies. 

• NHTSA will continue its plans to enhance its knowledge and capabilities in the area of 
safety-critical vehicle electronics, including electronic control systems, both by ensuring 
that current staff continues to be well infonned on the developing technologies and 
potential safety issues and by hiring (as agency needs dictate and funding permits) more 
staff with the necessary expertise. 
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